CVE-2020-5410 VMware Tanzu Spring Cloud Config Directory Traversal
Attackers can read arbitrary configuration files from the server via crafted URLs in Spring Cloud Config Server.
- Exploited in the wild
- Since 25 Mar 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-5410?
CVE-2020-5410 is a high-severity path traversal vulnerability in Spring Cloud Config, published on 2 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Which versions are affected by CVE-2020-5410?
4 open source packages ship an affected version, including org.springframework.cloud:spring-cloud-config-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.cloud:spring-cloud-config-server Maven | From 2.1.0 | 2.1.9 |
org.springframework.cloud:spring-cloud-config-server Maven | From 2.1.0 | 2.1.9 |
org.springframework.cloud:spring-cloud-config-server Maven | From 2.2.0 | 2.2.3 |
org.springframework.cloud:spring-cloud-config-server Maven | From 2.2.0 | 2.2.3 |
Products include Vmware Spring Cloud Config.
How do I fix CVE-2020-5410?
Upgrade org.springframework.cloud:spring-cloud-config-server to a fixed version for your release line: 2.1.9 or 2.2.3. US federal agencies must fix it by 15 Apr 2022.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-5410 being exploited?
Yes. Attackers have exploited CVE-2020-5410 in the wild since at least 25 Mar 2022.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in Spring Cloud Config
- CVE-2026-40982 Spring Cloud Config vulnerable to Path Traversal
- CVE-2026-22739 Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
- CVE-2026-40981 Spring Cloud Config has an Authorization Bypass Through User-Controlled Key
- CVE-2026-41002 Spring Cloud Config Server Susceptible To TOCTOU Attack
- CVE-2026-47836 Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
Sources
Also known as GHSA-32xf-jwmv-9hf3.