CVE-2020-5410
Directory Traversal with spring-cloud-config-server
- State
- Published
- Severity
- 7.5 High
- Published
- Jun 2, 2020
- Updated
- Oct 21, 2025
- Reserved
- Jan 3, 2020
Description
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-23 Relative Path Traversal
Affected Products
| Product | Versions |
|---|---|
Spring Cloud ConfigSpring by VMware |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.