CVE-2020-5410

HIGHCISA KEV

7.5

Description

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published6/2/2020

Last Modified11/3/2025

Sourcekev

Honeypot Sightings0

CISA KEV

VendorVMware Tanzu

ProductSpring Cloud Configuration (Config) Server

Vulnerability NameVMware Tanzu Spring Cloud Config Directory Traversal Vulnerability

KEV Date Added2022-03-25

Remediation Due Date2022-04-15

Ransomware UseUnknown

Affected Products

vmware:spring_cloud_config

Weaknesses (CWE)

CWE-23CWE-22

References

https://tanzu.vmware.com/security/cve-2020-5410(security@pivotal.io)

https://tanzu.vmware.com/security/cve-2020-5410(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5410(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.