Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-3799

CWE-22 — Path Traversal9 documents9 sources

Severity

6.5MEDIUM

EPSS

89.9%

top 0.43%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Spring Spring Cloud Config Vmware Spring Cloud Config Oracle Communications Cloud Native Core Policy

Timeline

PublishedMay 6

Latest updateApr 15

Description

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶Mavenorg.springframework.cloud:spring-cloud-config-server2.0.0 — 2.0.4+2

▶CVEListV5spring/spring_cloud_config2.0 — v2.0.4.RELEASE+2

▶NVDvmware/spring_cloud_config1.4.0 — 1.4.6+2

▶NVDoracle/communications_cloud_native_core_policy1.15.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

GHSA

Path Traversal in Spring Cloud Config↗2019-05-23

▶

OSV

Path Traversal in Spring Cloud Config↗2019-05-23

▶

CVEList

Directory Traversal with spring-cloud-config-server↗2019-05-06

▶

💥Exploits & PoCs

Exploit-DB

Spring Cloud Config 2.1.x - Path Traversal (Metasploit)↗2019-04-30

▶

Nuclei

Spring Cloud Config Server - Local File Inclusion

▶

📋Vendor Advisories

Oracle

Oracle Oracle Communications Risk Matrix: Policy (Spring Cloud Config) — CVE-2019-3799↗2022-04-15

▶

Red Hat

spring-cloud-config-server: directory traversal attack using special crafted URL↗2019-04-16

▶

💬Community

Bugzilla

CVE-2019-3799 spring-cloud-config-server: directory traversal attack using special crafted URL↗2019-05-13

▶