VULNERABILITY INTELLIGENCE

CVE-2020-5410

CVSS score7.5 HIGH
EPSS probability95.59%
CISA KEVKnown exploited vulnerability
Published2020-06-02
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Known Exploited Vulnerability

VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability

Vendor / product: VMware Tanzu / Spring Cloud Configuration (Config) Server

Description

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.

Weakness classification

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-23: Relative Path Traversal

Primary references