spring-cloud-config-server: sending a request using a specially crafted URL can lead to a directory traversal attack

A flaw was found in spring-cloud-config in versions prior to 2.1.9 and 2.2.3. Applications are allowed to serve arbitrary configuration files through the spring-cloud-config-server module allowing an attacker to send a request using a specially crafted URL to create a directory traversal attack...

Moderate: Red Hat Security Advisory: Red Hat Fuse 7.9.0 release and security update

A minor version update from 7.8 to 7.9 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring...

The vulnerability of the spring-cloud-config-server module of the Spring Cloud Config server allows a attacker to gain access to protected information.

The vulnerability of the spring-cloud-config-server module in the Spring Cloud Config server exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to protected informatio...

Directory Traversal in Spring Cloud Config Server

This module exploits an unauthenticated directory traversal vulnerability which exists in Spring Cloud Config versions 2.2.x prior to 2.2.3 and 2.1.x prior to 2.1.9, and older unsupported versions. Spring Cloud Config listens by default on port 8888. This module requires Metasploit:...

Exploit for Path Traversal in Vmware Spring_Cloud_Config

CVE-2020-5410 Spring Cloud Config directory traversal vulnera...

Directory traversal attack in Spring Cloud Config

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

ai.hyacinth.framework:core-service-config-server (>=0.5.0 <=0.5.21), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (>=2.1.0.RELEASE <=2.1.1.RELEASE) +18 more potentially affected by CVE-2020-5410 via org.springframework.cloud:spring-cloud-config-server (>=2.1.0.RELEASE <=2.1.8.RELEASE)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.1.0.RELEASE, =0.5.0, =2.1.0.RELEASE, =1.2.0, =1.0.0, =6.0.1, =6.0.1, =6.0.1, =2.1.0.RELEASE, =2.1.0.RELEASE, =2.1.0.RELEASE, =2.1.0.RELEASE, =2.1.4.RELEASE - org.springframework.cloud.stream.app:python-jython-processor-ra...

ai.hyacinth.framework:core-service-config-server (=0.5.24), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (=3.1.0.RELEASE) +34 more potentially affected by CVE-2020-5410 via org.springframework.cloud:spring-cloud-config-server (>=2.2.0.RELEASE <=2.2.2.RELEASE)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.2.0.RELEASE, =0.0.1-RELEASE, =1.1.1, =0.1.0, =0.2.0 and more Source cves: CVE-2020-5410 Source advisory: OSV:GHSA-32XF-JWMV-9HF3https://vulners...

GHSA-32XF-JWMV-9HF3 Directory traversal attack in Spring Cloud Config

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

ai.hyacinth.framework:core-service-config-server (=0.5.24), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (=3.1.0.RELEASE) +12 more potentially affected by CVE-2020-5405 via org.springframework.cloud:spring-cloud-config-server (>=2.2.0.RELEASE <=2.2.1.RELEASE)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.2.0.RELEASE, =0.0.1-RELEASE, =6.2.0-RC1, =6.2.0-RC1, =2.2.0.RELEASE, =2.2.0.RELEASE, =2.2.1.RELEASE Source cves: CVE-2020-5405 Source advisory: OSV...

ai.hyacinth.framework:core-service-config-server (>=0.5.0 <=0.5.21), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (>=2.1.0.RELEASE <=2.1.1.RELEASE) +17 more potentially affected by CVE-2020-5405 via org.springframework.cloud:spring-cloud-config-server (>=2.1.0.RELEASE <=2.1.6.RELEASE)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.1.0.RELEASE, =0.5.0, =2.1.0.RELEASE, =1.2.0, =1.0.0, =6.0.1, =6.0.1, =6.0.1, =2.1.0.RELEASE, =2.1.0.RELEASE, =2.1.0.RELEASE, =2.1.0.RELEASE, =2.1.0.RELEASE, =2.1.4.RELEASE - org.springframework.cloud.stream.app:spring-...

GHSA-G86W-V5VG-9GXF Directory traversal attack in Spring Cloud Config

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

Directory Traversal

spring-cloud-config-server is vulnerable to directory traversal. The vulnerability exists as it does not verify that the resources are served from allowed locations. An attacker is able to retrieve and read arbitrary system files using file:// or ../ characters...

CVE-2020-5410

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

CVE-2020-5410

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

Directory traversal

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

CVE-2020-5410 Directory Traversal with spring-cloud-config-server

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

CVE-2020-5410

CVE-2020-5410 affects VMware/Tanzu Spring Cloud Config Server. Versions 2.2.x before 2.2.3 and 2.1.x before 2.1.9 (and older unsupported) are vulnerable to a directory-traversal where a crafted URL can cause the server to serve arbitrary configuration files. Root cause: inadequate validation in t...

CVE-2020-5410 Directory Traversal with spring-cloud-config-server

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

PT-2020-4063 · Spring · Spring Cloud Config

Name of the Vulnerable Software and Affected Versions: Spring Cloud Config versions 2.1.x prior to 2.1.9 Spring Cloud Config versions 2.2.x prior to 2.2.3 Spring Cloud Config older unsupported versions Description: The issue allows applications to serve arbitrary configuration files through the...