{"id":"CVE-2019-3799","published":"2019-05-06T15:21:37Z","modified":"2024-09-17T00:16:21Z","title":"Directory Traversal with spring-cloud-config-server","vendor":"Spring","product":"Spring Cloud Config","tier":"core","eol":null,"affectedVersions":[{"vendor":"Spring","product":"Spring Cloud Config","versions":[">= 2.0, < v2.0.4.RELEASE",">= 1.4, < v1.4.6.RELEASE",">= 2.1, < v2.1.2.RELEASE"]}],"description":{"text":"Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.","provenance":"source","from":"CVE.org"},"summary":{"text":"Spring Cloud Config's spring-cloud-config-server module contains a path traversal flaw that causes it to serve arbitrary configuration files from the server. An attacker who can send a specially crafted URL to the server can exploit it to read files outside the intended directory, with no authentication, user interaction, or specific configuration described as required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:15:05Z"},"cvss":null,"epss":{"score":0.85295,"percentile":0.99715,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":3,"pulses":[{"name":"SCANID: S-KhOoOrXsco8: Thor Lite Linux 64 - Sample Lab Device 2 - incomplete (not enriched)","url":"https://otx.alienvault.com/pulse/67c6bb5aa601e91b1314ff44","created":"2025-03-04"},{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"},{"name":"Oracle Critical Patch Update Advisory - April 2022","url":"https://otx.alienvault.com/pulse/626040216e00cd388b1b9180","created":"2022-04-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC"]},{"url":"https://pivotal.io/security/cve-2019-3799","tags":["x_refsource_CONFIRM"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"exploitation_technique","evidence":[],"confidence":"high"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"primary_impact","evidence":[],"confidence":"high"}],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","vulnerableRanges":["<1.4.6",">=2.0.0, <2.0.4",">=2.1.0, <2.1.2"],"patched":["1.4.6","2.0.4","2.1.2"],"from":["GHSA-4x49-w62v-76q7"],"provenance":"source"}],"advisories":[{"id":"GHSA-4x49-w62v-76q7","url":"https://github.com/advisories/GHSA-4x49-w62v-76q7","severity":"MODERATE","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","vulnerableRanges":["<1.4.6"],"patched":["1.4.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4x49-w62v-76q7","url":"https://github.com/advisories/GHSA-4x49-w62v-76q7","severity":"MODERATE","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","vulnerableRanges":[">=2.0.0, <2.0.4"],"patched":["2.0.4"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4x49-w62v-76q7","url":"https://github.com/advisories/GHSA-4x49-w62v-76q7","severity":"MODERATE","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","vulnerableRanges":[">=2.1.0, <2.1.2"],"patched":["2.1.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2019-0450","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0450","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":46772,"url":"https://www.exploit-db.com/exploits/46772","title":"Spring Cloud Config 2.1.x - Path Traversal (Metasploit)","type":"webapps","platform":"java","date":"2019-04-30","verified":false,"provenance":"source"},{"id":46772,"url":"https://www.exploit-db.com/exploits/46772","title":"Spring Cloud Config 2.1.x - Path Traversal (Metasploit)","type":"webapps","platform":"java","date":"2019-04-30","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2019-04-30"},"pocGithub":{"count":2,"skipped":0,"earliest":"2019-04-17","earliestUrl":"https://github.com/mpgn/CVE-2019-3799","repos":[{"name":"mpgn/CVE-2019-3799","url":"https://github.com/mpgn/CVE-2019-3799","stars":31,"created":"2019-04-17"},{"name":"Corgizz/SpringCloud","url":"https://github.com/Corgizz/SpringCloud","stars":0,"created":"2022-04-07"}]},"metasploit":[{"name":"Spring Cloud Config Server Directory Traversal","module":"auxiliary/scanner/http/springcloud_traversal","type":"auxiliary","disclosureDate":"2019-04-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/springcloud_traversal.rb"}],"nuclei":[{"id":"CVE-2019-3799","name":"Spring Cloud Config Server - Local File Inclusion","severity":"medium","path":"http/cves/2019/CVE-2019-3799.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3799.yaml"}],"first":{"date":"2019-04-17","source":"PoC-in-GitHub","url":"https://github.com/mpgn/CVE-2019-3799"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1005"],"provenance":"source"}],"timeline":[{"date":"2019-04-17","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2019-04-17, Exploit-DB 2019-04-30","url":"https://github.com/mpgn/CVE-2019-3799","provenance":"source"},{"date":"2019-05-06","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-3799","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":26.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9971"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 Exploit-DB entries; 2 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2019-3799","published":"2019-05-06","fixed":"2.1.2","kev":false},{"cve":"CVE-2020-5405","published":"2020-03-05","fixed":"2.2.2","kev":false,"link":{"from":"CVE-2019-3799","to":"CVE-2020-5405","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework.cloud:spring-cloud-config-server","fromFixed":"2.1.2","toFixed":"2.1.7","daysApart":304}]}},{"cve":"CVE-2020-5410","published":"2020-06-02","fixed":"2.2.3","kev":true},{"cve":"CVE-2026-22739","published":"2026-03-24","fixed":"5.0.2","kev":false}],"package":"Maven:org.springframework.cloud:spring-cloud-config-server"}}