ai.hyacinth.framework:core-service-config-server (0.5.24), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +12 more potentially affected by CVE-2020-5405 via org.springframework.cloud:spring-cloud-config-server (>=2.2.0.release, <=2.2.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.2.0.release, =6.2.0-rc1, =6.2.0-rc1, =2.2.0.release, =2.2.0.release, =2.2.1.release Source cves: CVE-2020-5405 Source advisory: GHSA-G86W-V5VG-9GXFhttps://vu...

ai.hyacinth.framework:core-service-config-server (0.5.24), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +12 more potentially affected by CVE-2020-5405 via org.springframework.cloud:spring-cloud-config-server (>=2.2.0.release, <=2.2.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.2.0.release, =6.2.0-rc1, =6.2.0-rc1, =2.2.0.release, =2.2.0.release, =2.2.1.release Source cves: CVE-2020-5405 Source advisory: OSV:GHSA-G86W-V5VG-9GXFhttps:...

ai.hyacinth.framework:core-service-config-server (>=0.5.0, <=0.5.21), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (>=2.1.0.release, <=2.1.1.release) +17 more potentially affected by CVE-2020-5405 via org.springframework.cloud:spring-cloud-config-server (>=2.1.0.release, <=2.1.6.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.1.0.release, =0.5.0, =2.1.0.release, =1.2.0, =1.0.0, =6.0.1, =6.0.1, =6.0.1, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.0.release, =2.1.4.release - org.springframework.cloud.stream.app:spring-cl...

Directory Traversal

spring-cloud-config-server is vulnerable to directory traversal. The vulnerability exists as it does not verify that the resources are served from allowed locations. An attacker is able to retrieve and read arbitrary system files using file:// or ../ characters...

CVE-2020-5410

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

CVE-2020-5410: Relative Path Traversal

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

CVE-2020-5405

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

CVE-2020-5405: Relative Path Traversal

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

PT-2020-18461

Name of the Vulnerable Software and Affected Versions Spring Cloud Config versions 2.2.x prior to 2.2.2 Spring Cloud Config versions 2.1.x prior to 2.1.7 Spring Cloud Config older unsupported versions Description The issue allows applications to serve arbitrary configuration files through the...

CVE-2020-5405

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +107 more potentially affected by CVE-2019-10184 via io.undertow:undertow-servlet (1.4.23.final)

io.undertow:undertow-servlet MAVEN version 1.4.23.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-servlet and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1, =0.0.1, =5.1.0, =1.3.0-rc.15-release,...

com.okta.spring.examples:okta-spring-boot-cloud-config-example (>=1.0.0, <=1.1.0), com.yoozoo.protoconf:protoconf-java (>=0.2.2, <=0.2.3) +9 more potentially affected by CVE-2019-3799 via org.springframework.cloud:spring-cloud-config-server (>=2.0.0.release, <=2.0.3.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.0.0.release, =1.0.0, =0.2.2, =1.0.2, =0.0.2, =darwin.release, =0.2.1.release, =2.0.0.release, =2.0.3.release - xyz.weechang:moreco-cloud-config 0.0.1 Source cves: CVE-2019-3799 Source advisory: GHSA-4X49-W62V-76Q7...

cn.home1:oss-configserver (>=1.0.6.oss, <=1.0.7.oss), cn.home1:spring-cloud-config-monitor (>=0.0.1, <=1.0.1.u1) +166 more potentially affected by CVE-2019-3799 via org.springframework.cloud:spring-cloud-config-server (>=1.1.0.release, <=1.4.5.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version =1.1.0.release, =1.0.6.oss, =0.0.1, =0.0.1, =1.1.0-release, =1.0.0, =1.0.0, =1.5.0-beta, =0.8.3, =0.8.3, =0.8.3, =0.8.3, =0.10.0 and more Source cves: CVE-2019-3799 Source advisory: OSV:GHSA-4X49-W62V-76Q7...

cn.home1:oss-configserver (>=1.0.6.oss, <=1.0.7.oss), cn.home1:spring-cloud-config-monitor (>=0.0.1, <=1.0.1.u1) +166 more potentially affected by CVE-2019-3799 via org.springframework.cloud:spring-cloud-config-server (>=1.1.0.release, <=1.4.5.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version =1.1.0.release, =1.0.6.oss, =0.0.1, =0.0.1, =1.1.0-release, =1.0.0, =1.0.0, =1.5.0-beta, =0.8.3, =0.8.3, =0.8.3, =0.8.3, =0.10.0 and more Source cves: CVE-2019-3799 Source advisory: GHSA-4X49-W62V-76Q7...

com.okta.spring.examples:okta-spring-boot-cloud-config-example (>=1.0.0, <=1.1.0), com.yoozoo.protoconf:protoconf-java (>=0.2.2, <=0.2.3) +9 more potentially affected by CVE-2019-3799 via org.springframework.cloud:spring-cloud-config-server (>=2.0.0.release, <=2.0.3.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.0.0.release, =1.0.0, =0.2.2, =1.0.2, =0.0.2, =darwin.release, =0.2.1.release, =2.0.0.release, =2.0.3.release - xyz.weechang:moreco-cloud-config 0.0.1 Source cves: CVE-2019-3799 Source advisory: OSV:GHSA-4X49-W62V-76Q7...

ai.hyacinth.framework:core-service-config-server (0.5.0), org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=6.0.1, <=6.1.0-rc2) +12 more potentially affected by CVE-2019-3799 via org.springframework.cloud:spring-cloud-config-server (>=2.1.0.release, <=2.1.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.1.0.release, =6.0.1, =6.0.1, =6.0.1, =einstein.release, =2.1.0.release, =2.1...

ai.hyacinth.framework:core-service-config-server (0.5.0), org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=6.0.1, <=6.1.0-rc2) +12 more potentially affected by CVE-2019-3799 via org.springframework.cloud:spring-cloud-config-server (>=2.1.0.release, <=2.1.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.1.0.release, =6.0.1, =6.0.1, =6.0.1, =einstein.release, =2.1.0.release, =2.1...

CVE-2019-3799

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a...

CVE-2019-3799 Directory Traversal with spring-cloud-config-server

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a...

CVE-2019-3799: Improper Limitation of a Pathname to a Restricted Directory

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a...