GHSA-g86w-v5vg-9gxfMediumCVSS 6.5

Directory traversal attack in Spring Cloud Config

Published
June 5, 2020
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-5405 →

📋 Description

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.

🎯 Affected products2

  • maven/org.springframework.cloud:spring-cloud-config-server:>= 2.1.0, < 2.1.7
  • maven/org.springframework.cloud:spring-cloud-config-server:>= 2.2.0, < 2.2.2

🔗 References (3)