WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕EPSS ≥ 0.5✕Product spring-cloud-config-server✕
Overview 3 matches · 1 exploited · 1 CISA KEV
3matches 1exploited33.3% 1CISA KEV33.3%
Protected by Waratek 3 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 1 33.3% Medium 2 66.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 33.3% Working exploit published 2 66.7% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / month
Protected by Waratek: 3 Medium: 2High: 1 blocked by ARMR today: 3 Working exploit published: 2Exploited: 1
May 191 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 Jun 190 Jul 190 Aug 190 Sep 190 Oct 190 Nov 190 Dec 190 Jan 200 Feb 200 Mar 201 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 Apr 200 May 200 Jun 201 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1
Jun 19Aug 19Oct 19Dec 19Feb 20Apr 20Jun 20
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-5410 High 2020-06-02 Protected by Waratek Exploited Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
CVE-2020-5405 Medium 2020-03-05 Protected by Waratek Working exploit published Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
CVE-2019-3799 Medium 2019-05-06 Protected by Waratek Working exploit published Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.