CVE-2020-5410

VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability

Spring Cloud Config

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.

2. Jun 2020

Ausgewertete Quellen

• Hersteller
  https://tanzu.vmware.com/security/cve-2020-5410
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5410
• CISA
  VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
• NVD
  CVE-2020-5410