Actively exploited · Published Jun 2, 2020 · Assigned by pivotal
CVE-2020-5410Directory Traversal with spring-cloud-config-server
High 7.5 Exploited
In plain English
A high-severity security flaw in Spring Cloud Config from Spring by VMware. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 95.6% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Apr 15, 2022.
Official description
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-config-server | 2.1.9 | GHSA-32xf-jwmv-9hf3 |
| Maven | org.springframework.cloud:spring-cloud-config-server | 2.2.3 | GHSA-32xf-jwmv-9hf3 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring by VMware | Spring Cloud Config | 2.1 – before 2.1.92.2 – before 2.2.3 |
Weakness: CWE-23 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://tanzu.vmware.com/security/cve-2020-5410 x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5410 government-resource