Patchfirst
Patchfirst
CVE-2020-5410 KEVPublic exploit High · 7.5 EPSS 95.6%

VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability

VMware Tanzu · Spring Cloud Configuration (Config) Server

Summary

A directory traversal flaw in the spring-cloud-config-server module of VMware Tanzu's Spring Cloud Configuration (Config) Server allows applications to serve arbitrary configuration files. An unauthenticated remote attacker, with no user interaction, can exploit it by sending a specially crafted URL to read files outside the intended directory.

Official description · NVD

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.

Breakdown
68.2 / 100
Exploited
Yes, in CISA KEV
Reports
0
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 19 months after disclosure. Public exploit code (Metasploit) was available 1 day before disclosure.

  1. Public exploit codeMetasploit1 day before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidence+19 mo
  4. Added to CISA KEVEU database agrees+22 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

2 related vulnerabilities in the same code over 3 months. The latest fix listed for spring-cloud-config-server is 5.0.3.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2020-5405Directory Traversal with spring-cloud-config-server5 Mar 2020
  2. Next fix in the same packageMedium

    Why these are linked:

    • Fixed one release later2.1.7 → 2.1.9 (org.springframework.cloud:spring-cloud-config-server)
    • Similar weakness in the same product (machine-matched)same package + description similarity
    This CVECVE-2020-5410VMware Tanzu Spring Cloud Config Directory Traversal2 Jun 2020KEV

Fixes in spring-cloud-config-serverMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.1.2CVE-2019-37996 May 2019
  2. 2.2.2CVE-2020-54055 Mar 2020
  3. 2.2.3CVE-2020-54102 Jun 2020KEV
  4. 5.0.2CVE-2026-2273924 Mar 2026
  5. 5.0.3CVE-2026-409817 May 2026
  6. 5.0.3CVE-2026-409827 May 2026Latest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium
AI mapping from the description · how it is exploited

Remote unauthenticated request to public-facing server application

A malicious user, or attacker, can send a request using a specially crafted URL
From the official description (NVD) Original (opens in a new tab) ↗

CollectionTA0009

Data from Local System T1005 Medium
AI mapping from the description · primary impact

Traversal enables arbitrary file read from server

allow applications to serve arbitrary configuration files
From the official description (NVD) Original (opens in a new tab) ↗

Detection

0 rules for this CVE · 163 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-5410 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Data from Local SystemT100514 general rules
All 14 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.springframework.cloud:spring-cloud-config-server.

Mavenorg.springframework.cloud:spring-cloud-config-serverGHSA-32xf-jwmv-9hf3

Upgrade to 2.2.3 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2020-5405).

Set the version to 2.2.3 or later in your pom.xml or build.gradle.

The first fix for CVE-2020-5410.

Affected versions, by release line

If you runUpgrade to
2.2.0 up to 2.2.32.2.3
2.1.0 up to 2.1.92.1.9

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag (1 duplicate merged)

Vendor Advisory 1

tanzu.vmware.com/security/cve-2020-5410

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5410
↑ ↓ chooseEnter openEsc close