CVE-2020-5410 - Vulnerability Details - OpenCVE

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is in the KEV database since March 25, 2022.

Exploitation active

Automatable yes

Technical Impact partial

Vendors	Products
Redhat	Jboss Fuse
Vmware	Spring Cloud Config

Configuration 1 [-]

OR	cpe:2.3:a:vmware:spring_cloud_config::::::::
	cpe:2.3:a:vmware:spring_cloud_config::::::::

Package	CPE	Advisory	Released Date
Red Hat Fuse 7.8.0
	cpe:/a:redhat:jboss_fuse:7	RHSA-2020:5568	2020-12-16T00:00:00Z
Red Hat Fuse 7.9
spring-cloud-config-server	cpe:/a:redhat:jboss_fuse:7	RHSA-2021:3140	2021-08-11T00:00:00Z

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2020-5410
https://tanzu.vmware.com/security/cve-2020-5410
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://www.cve.org/CVERecord?id=CVE-2020-5410

History

Fri, 07 Feb 2025 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		kev `{'dateAdded': '2022-03-25'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 14 Aug 2024 00:45:00 +0000

Type	Values Removed	Values Added
References		https://www.cisa.gov/known-exploited-vulnerabilities-catalog

MITRE

Status: PUBLISHED

Assigner: pivotal

Published: 2020-06-02T16:50:12.055Z

Updated: 2025-02-07T12:44:18.402Z

Reserved: 2020-01-03T00:00:00.000Z

Link: CVE-2020-5410

Vulnrichment

Updated: 2024-08-04T08:30:24.192Z

NVD

Status : Analyzed

Published: 2020-06-02T17:15:11.690

Modified: 2025-02-07T15:02:48.683

Link: CVE-2020-5410

Redhat

Severity : Important

Publid Date: 2020-05-15T00:00:00Z

Links: CVE-2020-5410 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "Spring Cloud Config", "vendor": "Spring by VMware", "versions": [{"lessThan": "2.1.9", "status": "affected", "version": "2.1", "versionType": "custom"}, {"lessThan": "2.2.3", "status": "affected", "version": "2.2", "versionType": "custom"}]}], "datePublic": "2020-06-01T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-23", "description": "CWE-23: Relative Path Traversal", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-06-02T16:50:11.000Z", "orgId": "862b2186-222f-48b9-af87-f1fb7bb26d03", "shortName": "pivotal"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://tanzu.vmware.com/security/cve-2020-5410"}], "source": {"discovery": "UNKNOWN"}, "title": "Directory Traversal with spring-cloud-config-server", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@pivotal.io", "DATE_PUBLIC": "2020-06-01T00:00:00.000Z", "ID": "CVE-2020-5410", "STATE": "PUBLIC", "TITLE": "Directory Traversal with spring-cloud-config-server"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Spring Cloud Config", "version": {"version_data": [{"version_affected": "<", "version_name": "2.1", "version_value": "2.1.9"}, {"version_affected": "<", "version_name": "2.2", "version_value": "2.2.3"}]}}]}, "vendor_name": "Spring by VMware"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack."}]}, "impact": null, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-23: Relative Path Traversal"}]}]}, "references": {"reference_data": [{"name": "https://tanzu.vmware.com/security/cve-2020-5410", "refsource": "CONFIRM", "url": "https://tanzu.vmware.com/security/cve-2020-5410"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T08:30:24.192Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://tanzu.vmware.com/security/cve-2020-5410"}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-02-07T12:43:59.584737Z", "id": "CVE-2020-5410", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2022-03-25", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-5410"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-07T12:44:18.402Z"}}]}, "cveMetadata": {"assignerOrgId": "862b2186-222f-48b9-af87-f1fb7bb26d03", "assignerShortName": "pivotal", "cveId": "CVE-2020-5410", "datePublished": "2020-06-02T16:50:12.055Z", "dateReserved": "2020-01-03T00:00:00.000Z", "dateUpdated": "2025-02-07T12:44:18.402Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://tanzu.vmware.com/security/cve-2020-5410", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T08:30:24.192Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2020-5410", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-07T12:43:59.584737Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2022-03-25", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-5410"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-07T12:43:45.959Z"}}], "cna": {"title": "Directory Traversal with spring-cloud-config-server", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Spring by VMware", "product": "Spring Cloud Config", "versions": [{"status": "affected", "version": "2.1", "lessThan": "2.1.9", "versionType": "custom"}, {"status": "affected", "version": "2.2", "lessThan": "2.2.3", "versionType": "custom"}]}], "datePublic": "2020-06-01T00:00:00.000Z", "references": [{"url": "https://tanzu.vmware.com/security/cve-2020-5410", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-23", "description": "CWE-23: Relative Path Traversal"}]}], "providerMetadata": {"orgId": "862b2186-222f-48b9-af87-f1fb7bb26d03", "shortName": "pivotal", "dateUpdated": "2020-06-02T16:50:11.000Z"}, "x_legacyV4Record": {"impact": null, "source": {"discovery": "UNKNOWN"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_name": "2.1", "version_value": "2.1.9", "version_affected": "<"}, {"version_name": "2.2", "version_value": "2.2.3", "version_affected": "<"}]}, "product_name": "Spring Cloud Config"}]}, "vendor_name": "Spring by VMware"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://tanzu.vmware.com/security/cve-2020-5410", "name": "https://tanzu.vmware.com/security/cve-2020-5410", "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-23: Relative Path Traversal"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2020-5410", "STATE": "PUBLIC", "TITLE": "Directory Traversal with spring-cloud-config-server", "ASSIGNER": "security@pivotal.io", "DATE_PUBLIC": "2020-06-01T00:00:00.000Z"}}}}, "cveMetadata": {"cveId": "CVE-2020-5410", "state": "PUBLISHED", "dateUpdated": "2025-02-07T12:44:18.402Z", "dateReserved": "2020-01-03T00:00:00.000Z", "assignerOrgId": "862b2186-222f-48b9-af87-f1fb7bb26d03", "datePublished": "2020-06-02T16:50:12.055Z", "assignerShortName": "pivotal"}, "dataVersion": "5.1"}

{"cisaActionDue": "2022-04-15", "cisaExploitAdd": "2022-03-25", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD89FB84-A583-4310-B217-43EFB4825969", "versionEndExcluding": "2.1.9", "versionStartIncluding": "2.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*", "matchCriteriaId": "286B290C-8CEA-4EE1-B899-ED799CFF2B44", "versionEndExcluding": "2.2.3", "versionStartIncluding": "2.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack."}, {"lang": "es", "value": "Spring Cloud Config, las versiones 2.2.x anteriores a 2.2.3, versiones 2.1.x anteriores a 2.1.9, y las versiones m\u00e1s antiguas no compatibles, permiten a las aplicaciones servir archivos de configuraci\u00f3n arbitrarios por medio del m\u00f3dulo spring Cloud-config-server. Un usuario malicioso, o un atacante, puede enviar una petici\u00f3n usando una URL especialmente dise\u00f1ada que puede conllevar a un ataque de salto de directorio."}], "id": "CVE-2020-5410", "lastModified": "2025-02-07T15:02:48.683", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2020-06-02T17:15:11.690", "references": [{"source": "security@pivotal.io", "tags": ["Vendor Advisory"], "url": "https://tanzu.vmware.com/security/cve-2020-5410"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://tanzu.vmware.com/security/cve-2020-5410"}], "sourceIdentifier": "security@pivotal.io", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-23"}], "source": "security@pivotal.io", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}