CVE-2020-5405
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 68.8%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- EPSS
- 68.76% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-23, CWE-22
- Affected
- vmware/spring cloud config
- Source
- security@pivotal.io
References
- https://pivotal.io/security/cve-2020-5405Vendor Advisory
- https://pivotal.io/security/cve-2020-5405Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.