Read the docs
TI-2019-02811 Aliases CVE-2019-3799GHSA-4x49-w62v-76q7

Directory Traversal with spring-cloud-config-server

Priority HIGH 70CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.

Why it matters now

EPSS 0.85295 99th percentileScored 2026-11-07
Fix Partial Spring Cloud Config (Spring): v2.0.4.RELEASE, v1.4.6.RELEASE, v2.1.2.RELEASEorg.springframework.cloud:spring-cloud-config-server (Maven): 1.4.6, 2.0.4, 2.1.2Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareSpring Cloud Config2.0 to before v2.0.4.RELEASE; 1.4 to before v1.4.6.RELEASE; 2.1 to before v2.1.2.RELEASEv2.0.4.RELEASE, v1.4.6.RELEASE, v2.1.2.RELEASEPatch availableCNA
—org.springframework.cloud:spring-cloud-config-server (Maven)before 1.4.61.4.6Patch availableGHSA-4x49-w62v-76q7
—org.springframework.cloud:spring-cloud-config-server (Maven)2.0.0 to before 2.0.42.0.4Patch availableGHSA-4x49-w62v-76q7
—org.springframework.cloud:spring-cloud-config-server (Maven)2.1.0 to before 2.1.22.1.2Patch availableGHSA-4x49-w62v-76q7
  • Spring Cloud Config VendorVMware Affected 2.0 to before v2.0.4.RELEASE; 1.4 to before v1.4.6.RELEASE; 2.1 to before v2.1.2.RELEASE Fixed in v2.0.4.RELEASE, v1.4.6.RELEASE, v2.1.2.RELEASE Patch available CNA
  • org.springframework.cloud:spring-cloud-config-server (Maven) Vendor— Affected before 1.4.6 Fixed in 1.4.6 Patch available GHSA-4x49-w62v-76q7
  • org.springframework.cloud:spring-cloud-config-server (Maven) Vendor— Affected 2.0.0 to before 2.0.4 Fixed in 2.0.4 Patch available GHSA-4x49-w62v-76q7
  • org.springframework.cloud:spring-cloud-config-server (Maven) Vendor— Affected 2.1.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-4x49-w62v-76q7

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*1.4.0 to before 1.4.6; 2.0.0 to before 2.0.4; 2.1.0 to before 2.1.2VulnerableVMware
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
  • cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:* Versions 1.4.0 to before 1.4.6; 2.0.0 to before 2.0.4; 2.1.0 to before 2.1.2 Vulnerable ·VMware
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle

Remediation

  • Fix · CNA Spring Cloud Config (Spring) Fixed in v2.0.4.RELEASE, v1.4.6.RELEASE, v2.1.2.RELEASE
  • Fix · GHSA-4x49-w62v-76q7 org.springframework.cloud:spring-cloud-config-server (Maven) Fixed in 1.4.6 Advisory →
  • Fix · GHSA-4x49-w62v-76q7 org.springframework.cloud:spring-cloud-config-server (Maven) Fixed in 2.0.4 Advisory →
  • Fix · GHSA-4x49-w62v-76q7 org.springframework.cloud:spring-cloud-config-server (Maven) Fixed in 2.1.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3799
  2. 2026-10-03 Alias added: GHSA-4x49-w62v-76q7

References

Patch 1

Advisory 2

Other 1

  • TI-2020-04456 Directory Traversal with spring-cloud-config-server KEVCVSS 3.1HIGH 7.5
  • TI-2020-04451 Directory Traversal with spring-cloud-config-server CVSS 3.1MEDIUM 6.5
  • TI-2026-29633 Path traversal in VMware Spring Cloud Config CVSS 3.1CRITICAL 9.1
  • TI-2026-18263 Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks CVSS 3.1HIGH 8.6
  • TI-2026-35289 Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests CVSS 3.1CRITICAL 9.8
  • TI-2026-29632 Authorization bypass in VMware Spring Cloud Config CVSS 3.1HIGH 7.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences