CVE-2020-5410 : Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.

Published 2020-06-02 17:15:12

Updated 2022-09-20 19:10:15

Source Pivotal Software, Inc.

View at NVD, CVE.org

Vulnerability category: Directory traversal

Products affected by CVE-2020-5410

Vmware » Spring Cloud Config
Versions from including (>=) 2.2.0 and before (<) 2.2.3
cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*
Matching versions
Vmware » Spring Cloud Config
Versions from including (>=) 2.1.0 and before (<) 2.1.9
cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*
Matching versions

CVE-2020-5410 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2020-5410

Added on 2022-03-25 Action due date 2022-04-15

Exploit prediction scoring system (EPSS) score for CVE-2020-5410

EPSS FAQ

97.02%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-5410

Directory Traversal in Spring Cloud Config Server

Disclosure Date: 2020-06-01

First seen: 2020-07-06

auxiliary/scanner/http/springcloud_directory_traversal

This module exploits an unauthenticated directory traversal vulnerability which exists in Spring Cloud Config versions 2.2.x prior to 2.2.3 and 2.1.x prior to 2.1.9, and older unsupported versions. Spring Cloud Config listens by default on port 8888.

More information

CVSS scores for CVE-2020-5410

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2020-5410

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: nvd@nist.gov (Primary)
CWE-23 Relative Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Assigned by: security@pivotal.io (Secondary)

References for CVE-2020-5410

https://tanzu.vmware.com/security/cve-2020-5410

CVE-2020-5410: Directory Traversal with spring-cloud-config-server | Security | VMware Tanzu
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-5410