{"id":"CVE-2020-5410","aliases":["EUVD-2020-0451","GHSA-32xf-jwmv-9hf3"],"status":"published","title":"Directory Traversal with spring-cloud-config-server","description":"Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.95586,"percentile":0.99871,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-22","CWE-23"],"published":"2020-06-02T16:50:12Z","modified":"2026-10-24T10:30:51Z","kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-03-25"},{"source":"kev","since":"2022-03-25"}],"exploits":[{"source":"pocgithub","id":"dead5nd/config-demo","title":"dead5nd/config-demo","date":"2020-06-03","url":"https://github.com/dead5nd/config-demo"},{"source":"pocgithub","id":"shoucheng3/spring-cloud__spring-cloud-config_CVE-2020-5410_2-1-8-RELEASE","title":"shoucheng3/spring-cloud__spring-cloud-config_CVE-2020-5410_2-1-8-RELEASE","date":"2025-08-17","url":"https://github.com/shoucheng3/spring-cloud__spring-cloud-config_CVE-2020-5410_2-1-8-RELEASE"},{"source":"metasploit","id":"auxiliary/scanner/http/springcloud_directory_traversal","title":"Directory Traversal in Spring Cloud Config Server","type":"auxiliary","date":"2020-06-01","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/springcloud_directory_traversal"},{"source":"nuclei","id":"CVE-2020-5410","title":"Spring Cloud Config Server - Local File Inclusion","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5410.yaml"}],"fixes":[{"ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","fixed_in":["2.1.9","2.2.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.9"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.9"}]}],"versions":["2.1.0.RELEASE","2.1.1.RELEASE","2.1.2.RELEASE","2.1.3.RELEASE","2.1.4.RELEASE","2.1.5.RELEASE","2.1.6.RELEASE","2.1.7.RELEASE","2.1.8.RELEASE"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.3"}]}],"versions":["2.2.0.RELEASE","2.2.1.RELEASE","2.2.2.RELEASE"]}],"products":[{"vendor":"spring","product":"spring cloud config"},{"vendor":"spring by vmware","product":"spring cloud config"},{"vendor":"vmware","product":"spring_cloud_config"},{"vendor":"vmware tanzu","product":"spring cloud configuration (config) server"}],"references":[{"url":"https://tanzu.vmware.com/security/cve-2020-5410","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5410","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5410","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-32xf-jwmv-9hf3"},{"url":"https://github.com/spring-cloud/spring-cloud-config","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-5410","title":"Directory Traversal with spring-cloud-config-server","description":"Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.","status":"published","published":"2020-06-02T16:50:12.055Z","modified":"2025-10-21T23:35:43.023Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:35:47.56691Z"}],"euvd":[{"id":"EUVD-2020-0451","description":"Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.","status":"published","published":"2020-06-02T16:50:12Z","modified":"2025-10-21T23:35:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"exploited_since":"2022-03-25","updated_at":"2026-11-02T20:31:24.816637Z"}],"ghsa":[{"id":"GHSA-32xf-jwmv-9hf3","title":"Directory traversal attack in Spring Cloud Config","description":"Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.","status":"published","published":"2020-06-05T16:13:20Z","modified":"2025-10-22T17:52:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H","level":"high"}],"cwes":["CWE-22","CWE-23"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2020-5410","title":"VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability","description":"Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files.","cwes":["CWE-23"],"kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2020-5410","description":"Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.","status":"published","published":"2020-06-02T17:15:11.69Z","modified":"2026-06-17T03:21:26.55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-23","CWE-22"],"updated_at":"2026-11-02T14:06:04.922138Z"}],"osv":[{"id":"CVE-2020-5410","description":"Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.","status":"published","published":"2020-06-02T17:15:11.69Z","modified":"2026-10-24T10:30:51.102214786Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:16.936975Z"},{"id":"GHSA-32xf-jwmv-9hf3","title":"Directory traversal attack in Spring Cloud Config","description":"Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.","status":"published","published":"2020-06-05T16:13:20Z","modified":"2025-10-22T19:26:02.35039Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H","level":"high"}],"cwes":["CWE-22","CWE-23"],"updated_at":"2026-11-02T15:46:35.050232Z"}]}}