config-demo

CVE-2020-5410...

spring-cloud__spring-cloud-config_CVE-2020-5410_2-1-8-RELEASE

//// DO NOT EDIT THIS FILE. IT WAS GENERATED. Manual changes to this file will be lost when it is generated again. Edit the files in the src/main/asciidoc/ directory instead. //// image::https://circleci.com/gh/spring-cloud/spring-cloud-config/tree/master.svg?style=svg"CircleCI",...

Spring Cloud Config Server Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Directory Traversal in Spring Cloud Config Server', 'Description' = %q This module exploits an unauthenticated directory traversal vulnerability...

CVE-2020-5410

creationtimestamp| type| source ---|---|--- 2020-06-18 12:07:17+00:00| published-proof-of-concept| https://t.me/cKure/934 2020-07-06 14:58:44+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/springclouddirectorytraversal.rb 2023-06-14...

Exploit for Path Traversal in Vmware Spring_Cloud_Config

CVE-2020-5410 Spring Cloud Config directory traversal vulnera...

CVE-2020-5410

A flaw was found in spring-cloud-config in versions prior to 2.1.9 and 2.2.3. Applications are allowed to serve arbitrary configuration files through the spring-cloud-config-server module allowing an attacker to send a request using a specially crafted URL to create a directory traversal attack...

ai.hyacinth.framework:core-service-config-server (>=0.5.0, <=0.5.21), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (>=2.1.0.release, <=2.1.1.release) +18 more potentially affected by CVE-2020-5410 via org.springframework.cloud:spring-cloud-config-server (>=2.1.0.release, <=2.1.8.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.1.0.release, =0.5.0, =2.1.0.release, =1.2.0, =1.0.0, =6.0.1, =6.0.1, =6.0.1, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.4.release - org.springframework.cloud.stream.app:python-jython-processor-rabbi...

ai.hyacinth.framework:core-service-config-server (>=0.5.0, <=0.5.21), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (>=2.1.0.release, <=2.1.1.release) +18 more potentially affected by CVE-2020-5410 via org.springframework.cloud:spring-cloud-config-server (>=2.1.0.release, <=2.1.8.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.1.0.release, =0.5.0, =2.1.0.release, =1.2.0, =1.0.0, =6.0.1, =6.0.1, =6.0.1, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.4.release - org.springframework.cloud.stream.app:python-jython-processor-rabbi...

ai.hyacinth.framework:core-service-config-server (0.5.24), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +35 more potentially affected by CVE-2020-5410 via org.springframework.cloud:spring-cloud-config-server (>=2.2.0.release, <=2.2.2.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.2.0.release, =1.1.1, =0.1.0, =0.2.0 and more Source cves: CVE-2020-5410 Source advisory: OSV:GHSA-32XF-JWMV-9HF3https://vulners.com/osvghsa/OSV:GHSA-32XF-JWM...

ai.hyacinth.framework:core-service-config-server (0.5.24), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +35 more potentially affected by CVE-2020-5410 via org.springframework.cloud:spring-cloud-config-server (>=2.2.0.release, <=2.2.2.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.2.0.release, =1.1.1, =0.1.0, =0.2.0 and more Source cves: CVE-2020-5410 Source advisory: GHSA-32XF-JWMV-9HF3...

CVE-2020-5410 Directory Traversal with spring-cloud-config-server

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

CVE-2020-5410 Directory Traversal with spring-cloud-config-server

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

CVE-2020-5410

CVE-2020-5410 affects VMware/Tanzu Spring Cloud Config Server. Versions 2.2.x before 2.2.3 and 2.1.x before 2.1.9 (and older unsupported) are vulnerable to a directory-traversal where a crafted URL can cause the server to serve arbitrary configuration files. Root cause: inadequate validation in t...