Vulnerability · Published Mar 5, 2020 · Assigned by pivotal

CVE-2020-5405Directory Traversal with spring-cloud-config-server

Medium 6.5

In plain English

A medium-severity security flaw in Spring Cloud Config from Spring by VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 68.5% (higher than 99.3% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium

Exploit odds (30 days)68.5%top 0.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling2Nuclei, Public PoC

Official description

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.springframework.cloud:spring-cloud-config-server	2.1.7	GHSA-g86w-v5vg-9gxf
Maven	org.springframework.cloud:spring-cloud-config-server	2.2.2	GHSA-g86w-v5vg-9gxf

Affected products (as reported)

Vendor	Product	Versions
Spring by VMware	Spring Cloud Config	2.2 – before 2.2.22.1 – before 2.1.7

Weakness: CWE-23

References

https://pivotal.io/security/cve-2020-5405 x_refsource_CONFIRM