CVE-2019-3799

published 2019-05-06

CVE-2019-3799: Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow…

medium 6.5 CVSS 3.1

AV N AC L PR N UI R S U C H I N A N

EXPLOIT

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
oracle	communications_cloud_native_core_policy	—	—
spring	spring_cloud_config	>= 1.4 < v1.4.6.RELEASE	v1.4.6.RELEASE
spring	spring_cloud_config	>= 2.0 < v2.0.4.RELEASE	v2.0.4.RELEASE
spring	spring_cloud_config	>= 2.1 < v2.1.2.RELEASE	v2.1.2.RELEASE
vmware	spring_cloud_config	>= 1.4.0 < 1.4.6	1.4.6
vmware	spring_cloud_config	>= 2.0.0 < 2.0.4	2.0.4
vmware	spring_cloud_config	>= 2.1.0 < 2.1.2	2.1.2

CWE-22