CVE-2019-3799 Directory Traversal with spring-cloud-config-server

🗓️ 06 May 2019 15:21:37Reported by dellType

CVE-2019-3799 Directory Traversal in spring-cloud-config-serve

Reporter	Title	Published	Views	Family All 25
0day.today	Spring Cloud Config 2.1.x - Path Traversal Exploit	1 May 201900:00	–	zdt
BDU FSTEC	The vulnerability of the Spring Cloud Config server arises due to an incorrect path name limitation for the restricted access catalog, allowing attackers to expose the protected information.	11 May 202200:00	–	bdu_fstec
Circl	CVE-2019-3799	26 Apr 201914:45	–	circl
CNVD	Pivotal Software Spring Cloud Config Path Traversal Vulnerability	17 Apr 201900:00	–	cnvd
CVE	CVE-2019-3799	6 May 201915:21	–	cve
Exploit DB	Spring Cloud Config 2.1.x - Path Traversal (Metasploit)	30 Apr 201900:00	–	exploitdb
exploitpack	Spring Cloud Config 2.1.x - Path Traversal (Metasploit)	30 Apr 201900:00	–	exploitpack
Github Security Blog	Path Traversal in Spring Cloud Config	23 May 201908:39	–	github
Metasploit	Spring Cloud Config Server Directory Traversal	18 Apr 201907:24	–	metasploit
myhack58	Spring Cloud Config directory traversal vulnerability, CVE-2019-3799）early warning-vulnerability warning-the black bar safety net	19 Apr 201900:00	–	myhack58

[
  {
    "product": "Spring Cloud Config",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "v2.0.4.RELEASE",
        "status": "affected",
        "version": "2.0",
        "versionType": "custom"
      },
      {
        "lessThan": "v1.4.6.RELEASE",
        "status": "affected",
        "version": "1.4",
        "versionType": "custom"
      },
      {
        "lessThan": "v2.1.2.RELEASE",
        "status": "affected",
        "version": "2.1",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
oracle	www.oracle.com/security-alerts/cpuapr2022.html
pivotal	www.pivotal.io/security/cve-2019-3799

19 Apr 2022 23:20Current

6.7Medium risk

Vulners AI Score6.7

EPSS0.91358

CWE-22