{"id":"CVE-2019-3799","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-3799","generatedAt":"2026-10-27T21:17:36.196Z","title":"Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module.","description":"Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.","published":"2019-05-06T16:29:02.000Z","lastModified":"2026-06-17T02:35:37.000Z","status":"Modified","sourceIdentifier":"security_alert@emc.com","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},"cwe":["CWE-22"],"affected":["vmware/spring cloud config","oracle/communications cloud native core policy"],"epss":{"score":0.85295,"percentile":0.99714,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2019-04-30","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":46772,"kind":"exploit","title":"Spring Cloud Config 2.1.x - Path Traversal (Metasploit)","url":"https://www.exploit-db.com/exploits/46772","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/java/webapps/46772.rb","file":"exploits/java/webapps/46772.rb","published":"2019-04-30","added":"2019-04-30","updated":"2019-04-30","author":"Dhiraj Mishra","type":"webapps","platform":"java","port":8888,"verified":false,"codes":["CVE-2019-3799"],"tags":"Traversal","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 85.3%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://pivotal.io/security/cve-2019-3799","tags":["Vendor Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://pivotal.io/security/cve-2019-3799","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-3799","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}