CVE-2020-5405

Directory Traversal with spring-cloud-config-server

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.

Affected

Spring by VMware · Spring Cloud Config

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

68.54% chance of exploitation in the next 30 days, 99th percentile

Nuclei

medium

Published

2020-03-05

Updated

2024-09-16

Proof-of-concept exploits (1)

• shoucheng3/spring-cloud__spring-cloud-config_CVE-2020-5405_2-1-6-RELEASE0★ · 2025-08-20

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5405.yaml

Exploit collections (2)

• spring-cloud-cve-2020-5405.ymlchaitin/xray
• CVE-2020-5405.yamlzan8in/afrog

Security advisories

• https://pivotal.io/security/cve-2020-5405
• advisories/GHSA-g86w-v5vg-9gxf

References

• CVE Record
• NVD entry