Patchfirst
Patchfirst
CVE-2020-5405 Public exploit EPSS 68.5%

Directory Traversal with spring-cloud-config-server

Spring by VMware · Spring Cloud Config

Summary

The flaw is a directory traversal (relative path traversal) weakness in the spring-cloud-config-server module of Spring Cloud Config, which Spring by VMware produces. An attacker who can send requests to the config server can use a specially crafted URL to read arbitrary configuration files.

Official description · CVE.org

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.

Breakdown
26.2 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 5 Mar 2020. No public exploit code or confirmed exploitation is recorded.

See the family tree

2 related vulnerabilities in the same code over 3 months. The latest fix listed for spring-cloud-config-server is 5.0.3.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2020-5405Directory Traversal with spring-cloud-config-server5 Mar 2020
  2. Next fix in the same packageMedium

    Why these are linked:

    • Fixed one release later2.1.7 → 2.1.9 (org.springframework.cloud:spring-cloud-config-server)
    • Similar weakness in the same product (machine-matched)same package + description similarity
    CVE-2020-5410VMware Tanzu Spring Cloud Config Directory Traversal2 Jun 2020KEV

Fixes in spring-cloud-config-serverMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.1.2CVE-2019-37996 May 2019
  2. 2.2.2CVE-2020-54055 Mar 2020
  3. 2.2.3CVE-2020-54102 Jun 2020KEV
  4. 5.0.2CVE-2026-2273924 Mar 2026
  5. 5.0.3CVE-2026-409817 May 2026Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.springframework.cloud:spring-cloud-config-server.

Mavenorg.springframework.cloud:spring-cloud-config-serverGHSA-g86w-v5vg-9gxf

Upgrade to 2.2.3 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2020-5410).

Set the version to 2.2.3 or later in your pom.xml or build.gradle.

First fixed in 2.2.2 for CVE-2020-5405.

Affected versions, by release line

If you runUpgrade to
2.2.0 up to 2.2.22.2.3first fix for this CVE: 2.2.2
2.1.0 up to 2.1.72.1.9first fix for this CVE: 2.1.7

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 3 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

1 link, grouped by NVD tag

x_refsource_CONFIRM 1

pivotal.io/security/cve-2020-5405
↑ ↓ chooseEnter openEsc close