337 matches found
CVE-2021-20238
It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...
spring-cloud-config-server: sending a request using a specially crafted URL can lead to a directory traversal attack
A flaw was found in spring-cloud-config in versions prior to 2.1.9 and 2.2.3. Applications are allowed to serve arbitrary configuration files through the spring-cloud-config-server module allowing an attacker to send a request using a specially crafted URL to create a directory traversal attack...
ai.hyacinth.framework:core-service-config-server (>=0.5.0, <=0.5.21), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (>=2.1.0.release, <=2.1.1.release) +18 more potentially affected by CVE-2020-5410 via org.springframework.cloud:spring-cloud-config-server (>=2.1.0.release, <=2.1.8.release)
org.springframework.cloud:spring-cloud-config-server MAVEN version =2.1.0.release, =0.5.0, =2.1.0.release, =1.2.0, =1.0.0, =6.0.1, =6.0.1, =6.0.1, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.4.release - org.springframework.cloud.stream.app:python-jython-processor-rabbi...
ai.hyacinth.framework:core-service-config-server (>=0.5.0, <=0.5.21), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (>=2.1.0.release, <=2.1.1.release) +18 more potentially affected by CVE-2020-5410 via org.springframework.cloud:spring-cloud-config-server (>=2.1.0.release, <=2.1.8.release)
org.springframework.cloud:spring-cloud-config-server MAVEN version =2.1.0.release, =0.5.0, =2.1.0.release, =1.2.0, =1.0.0, =6.0.1, =6.0.1, =6.0.1, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.4.release - org.springframework.cloud.stream.app:python-jython-processor-rabbi...
ai.hyacinth.framework:core-service-config-server (0.5.24), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +35 more potentially affected by CVE-2020-5410 via org.springframework.cloud:spring-cloud-config-server (>=2.2.0.release, <=2.2.2.release)
org.springframework.cloud:spring-cloud-config-server MAVEN version =2.2.0.release, =1.1.1, =0.1.0, =0.2.0 and more Source cves: CVE-2020-5410 Source advisory: OSV:GHSA-32XF-JWMV-9HF3https://vulners.com/osvghsa/OSV:GHSA-32XF-JWM...
ai.hyacinth.framework:core-service-config-server (0.5.24), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +35 more potentially affected by CVE-2020-5410 via org.springframework.cloud:spring-cloud-config-server (>=2.2.0.release, <=2.2.2.release)
org.springframework.cloud:spring-cloud-config-server MAVEN version =2.2.0.release, =1.1.1, =0.1.0, =0.2.0 and more Source cves: CVE-2020-5410 Source advisory: GHSA-32XF-JWMV-9HF3...
ai.hyacinth.framework:core-service-config-server (>=0.5.0, <=0.5.21), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (>=2.1.0.release, <=2.1.1.release) +17 more potentially affected by CVE-2020-5405 via org.springframework.cloud:spring-cloud-config-server (>=2.1.0.release, <=2.1.6.release)
org.springframework.cloud:spring-cloud-config-server MAVEN version =2.1.0.release, =0.5.0, =2.1.0.release, =1.2.0, =1.0.0, =6.0.1, =6.0.1, =6.0.1, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.4.release - org.springframework.cloud.stream.app:spring-cl...
ai.hyacinth.framework:core-service-config-server (>=0.5.0, <=0.5.21), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (>=2.1.0.release, <=2.1.1.release) +17 more potentially affected by CVE-2020-5405 via org.springframework.cloud:spring-cloud-config-server (>=2.1.0.release, <=2.1.6.release)
org.springframework.cloud:spring-cloud-config-server MAVEN version =2.1.0.release, =0.5.0, =2.1.0.release, =1.2.0, =1.0.0, =6.0.1, =6.0.1, =6.0.1, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.4.release - org.springframework.cloud.stream.app:spring-cl...
ai.hyacinth.framework:core-service-config-server (0.5.24), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +12 more potentially affected by CVE-2020-5405 via org.springframework.cloud:spring-cloud-config-server (>=2.2.0.release, <=2.2.1.release)
org.springframework.cloud:spring-cloud-config-server MAVEN version =2.2.0.release, =6.2.0-rc1, =6.2.0-rc1, =2.2.0.release, =2.2.0.release, =2.2.1.release Source cves: CVE-2020-5405 Source advisory: OSV:GHSA-G86W-V5VG-9GXFhttps:...
ai.hyacinth.framework:core-service-config-server (0.5.24), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +12 more potentially affected by CVE-2020-5405 via org.springframework.cloud:spring-cloud-config-server (>=2.2.0.release, <=2.2.1.release)
org.springframework.cloud:spring-cloud-config-server MAVEN version =2.2.0.release, =6.2.0-rc1, =6.2.0-rc1, =2.2.0.release, =2.2.0.release, =2.2.1.release Source cves: CVE-2020-5405 Source advisory: GHSA-G86W-V5VG-9GXFhttps://vu...
Directory Traversal
spring-cloud-config-server is vulnerable to directory traversal. The vulnerability exists as it does not verify that the resources are served from allowed locations. An attacker is able to retrieve and read arbitrary system files using file:// or ../ characters...
VMware Spring Cloud Config Path Traversal Vulnerability
VMware Spring Cloud Config is a configuration management solution for distributed systems from VMware. The product is mainly for the external configuration of distributed systems to provide server and client support. A path traversal vulnerability exists in the Spring-cloud-config-server module i...
CVE-2020-5410
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...
CVE-2020-5410: Relative Path Traversal
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...
Directory Traversal with spring-cloud-config-server
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...
CVE-2020-5405
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...
CVE-2020-5405: Relative Path Traversal
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...
PT-2020-18461
Name of the Vulnerable Software and Affected Versions Spring Cloud Config versions 2.2.x prior to 2.2.2 Spring Cloud Config versions 2.1.x prior to 2.1.7 Spring Cloud Config older unsupported versions Description The issue allows applications to serve arbitrary configuration files through the...
CVE-2020-5405
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...
Directory Traversal with spring-cloud-config-server
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...