⚠ Actively exploited
Added to CISA KEV on 2022-03-25. Federal agencies required to patch by 2022-04-15. Required action: Apply updates per vendor instructions..
CVE-2020-5410
Severity
7.5HIGH
EPSS
94.4%
top 0.04%
CISA KEV
KEV
Added 2022-03-25
Due 2022-04-15
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedJun 2
KEV addedMar 25
KEV dueApr 15
Latest updateJan 15
CISA Required Action: Apply updates per vendor instructions.
Description
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6
Affected Packages3 packages
🔴Vulnerability Details
4💥Exploits & PoCs
1Nuclei▶
Spring Cloud Config Server - Local File Inclusion
🔍Detection Rules
1📋Vendor Advisories
3💬Community
1Bugzilla▶
CVE-2020-5410 spring-cloud-config-server: sending a request using a specially crafted URL can lead to a directory traversal attack↗2020-06-09