Read the docs
TI-2020-04456 Aliases CVE-2020-5410GHSA-32xf-jwmv-9hf3

Directory Traversal with spring-cloud-config-server

Priority CRITICAL 90Exploited in the wildCWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-23 and the CVSS impact.

Summary

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.

Why it matters now

Exploitation Active In CISA KEV since 2022-03-25CISA due date 2022-04-15
EPSS 0.95586 99th percentileScored 2026-11-07
Fix Fixed Spring Cloud Config (Spring by VMware): 2.1.9, 2.2.3org.springframework.cloud:spring-cloud-config-server (Maven): 2.1.9, 2.2.3Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareSpring Cloud Config2.1 to before 2.1.9; 2.2 to before 2.2.32.1.9, 2.2.3Patch availableCNA
—org.springframework.cloud:spring-cloud-config-server (Maven)2.1.0 to before 2.1.92.1.9Patch availableGHSA-32xf-jwmv-9hf3
—org.springframework.cloud:spring-cloud-config-server (Maven)2.2.0 to before 2.2.32.2.3Patch availableGHSA-32xf-jwmv-9hf3
  • Spring Cloud Config VendorVMware Affected 2.1 to before 2.1.9; 2.2 to before 2.2.3 Fixed in 2.1.9, 2.2.3 Patch available CNA
  • org.springframework.cloud:spring-cloud-config-server (Maven) Vendor— Affected 2.1.0 to before 2.1.9 Fixed in 2.1.9 Patch available GHSA-32xf-jwmv-9hf3
  • org.springframework.cloud:spring-cloud-config-server (Maven) Vendor— Affected 2.2.0 to before 2.2.3 Fixed in 2.2.3 Patch available GHSA-32xf-jwmv-9hf3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*2.1.0 to before 2.1.9; 2.2.0 to before 2.2.3VulnerableVMware
  • cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:* Versions 2.1.0 to before 2.1.9; 2.2.0 to before 2.2.3 Vulnerable ·VMware

Remediation

  • Fix · CNA Spring Cloud Config (Spring by VMware) Fixed in 2.1.9, 2.2.3
  • Fix · GHSA-32xf-jwmv-9hf3 org.springframework.cloud:spring-cloud-config-server (Maven) Fixed in 2.1.9 Advisory →
  • Fix · GHSA-32xf-jwmv-9hf3 org.springframework.cloud:spring-cloud-config-server (Maven) Fixed in 2.2.3 Advisory →

Red Hat 2 advisories

  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2020:5568 Released 2020-12-16 · Red Hat rating Important
    Red Hat Fuse 7.8.0 release and security update
    • Red Hat Fuse 7.8.0

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7.8.0Fixed RHSA-2020:5568
Red Hat Fuse 7.9Fixed RHSA-2021:3140

Timeline

  1. 2022-03-25 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2020-5410
  3. 2026-10-03 Alias added: GHSA-32xf-jwmv-9hf3

References

Advisory 2

Other 2

  • TI-2019-02811 Directory Traversal with spring-cloud-config-server CVSS 3.1MEDIUM 6.5
  • TI-2020-04451 Directory Traversal with spring-cloud-config-server CVSS 3.1MEDIUM 6.5
  • TI-2026-29633 Path traversal in VMware Spring Cloud Config CVSS 3.1CRITICAL 9.1
  • TI-2026-18263 Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks CVSS 3.1HIGH 8.6
  • TI-2026-35289 Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests CVSS 3.1CRITICAL 9.8
  • TI-2026-29632 Authorization bypass in VMware Spring Cloud Config CVSS 3.1HIGH 7.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences