CVE-2020-5405
MEDIUM 6.5EPSS 68.8%
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
- CVSS v3.1
- 6.5 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - CVSS v3.1
- 6.5 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - CVSS v2.0
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N - EPSS
- 68.76% chance of exploitation in the next 30 days, 99th percentile
- Nuclei
- medium
- Published
- 2020-03-05
- Updated
- 2024-09-16
Proof-of-concept exploits (1)
Nuclei templates (1)
Exploit collections (2)
- chaitin/xray/blob/master/pocs/spring-cloud-cve-2020-5405.yml
- zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2020/CVE-2020-5405.yaml