{"id":"CVE-2020-5405","published":"2020-03-05T19:00:19Z","modified":"2024-09-16T22:36:28Z","title":"Directory Traversal with spring-cloud-config-server","vendor":"Spring by VMware","product":"Spring Cloud Config","tier":"core","eol":null,"affectedVersions":[{"vendor":"Spring by VMware","product":"Spring Cloud Config","versions":[">= 2.2, < 2.2.2",">= 2.1, < 2.1.7"]}],"description":{"text":"Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a directory traversal (relative path traversal) weakness in the spring-cloud-config-server module of Spring Cloud Config, which Spring by VMware produces. An attacker who can send requests to the config server can use a specially crafted URL to read arbitrary configuration files.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:15:13Z"},"cvss":null,"epss":{"score":0.68542,"percentile":0.99335,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":3,"pulses":[{"name":"IOC's found on my pesonal devices; week starting 08/14/23","url":"https://otx.alienvault.com/pulse/65709ffcf3ffe737f8cb8dfd","created":"2023-12-06"},{"name":"IOC's found on my pesonal devices; week starting 08/14/23","url":"https://otx.alienvault.com/pulse/64dd9c1d76a7807782a691d3","created":"2023-08-17"},{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"}],"provenance":"machine"},"cwes":[{"id":"CWE-23","name":"Relative Path Traversal"}],"references":[{"url":"https://pivotal.io/security/cve-2020-5405","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","vulnerableRanges":[">=2.1.0, <2.1.7",">=2.2.0, <2.2.2"],"patched":["2.1.7","2.2.2"],"from":["GHSA-g86w-v5vg-9gxf"],"provenance":"source"}],"advisories":[{"id":"GHSA-g86w-v5vg-9gxf","url":"https://github.com/advisories/GHSA-g86w-v5vg-9gxf","severity":"MODERATE","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","vulnerableRanges":[">=2.1.0, <2.1.7"],"patched":["2.1.7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g86w-v5vg-9gxf","url":"https://github.com/advisories/GHSA-g86w-v5vg-9gxf","severity":"MODERATE","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","vulnerableRanges":[">=2.2.0, <2.2.2"],"patched":["2.2.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2020-0490","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0490","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2020-5405","name":"Spring Cloud Config - Local File Inclusion","severity":"medium","path":"http/cves/2020/CVE-2020-5405.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5405.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-03-05","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-5405","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":26.2,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.87,"detail":"percentile 0.9933"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-spring-cloud-config-cve-2020-5405","packageHistory":[{"cve":"CVE-2019-3799","published":"2019-05-06","fixed":"2.1.2","kev":false,"link":{"from":"CVE-2019-3799","to":"CVE-2020-5405","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework.cloud:spring-cloud-config-server","fromFixed":"2.1.2","toFixed":"2.1.7","daysApart":304}]}},{"cve":"CVE-2020-5405","published":"2020-03-05","fixed":"2.2.2","kev":false},{"cve":"CVE-2020-5410","published":"2020-06-02","fixed":"2.2.3","kev":true,"link":{"from":"CVE-2020-5405","to":"CVE-2020-5410","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework.cloud:spring-cloud-config-server","fromFixed":"2.1.7","toFixed":"2.1.9","daysApart":89},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same package + description similarity"}]}},{"cve":"CVE-2026-22739","published":"2026-03-24","fixed":"5.0.2","kev":false},{"cve":"CVE-2026-40981","published":"2026-05-07","fixed":"5.0.3","kev":false}],"package":"Maven:org.springframework.cloud:spring-cloud-config-server"}}