Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2020-5405
Severity
6.5MEDIUM
EPSS
88.0%
top 0.52%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedMar 5
Latest updateJun 15
Description
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6
Affected Packages3 packages
🔴Vulnerability Details
3💥Exploits & PoCs
1Nuclei▶
Spring Cloud Config - Local File Inclusion
🔍Detection Rules
1📋Vendor Advisories
1💬Community
1Bugzilla▶
CVE-2020-5405 spring-cloud-config-server: Directory Traversal with spring-cloud-config-server↗2020-04-24