WaratekVRT Sign in

CVE-2020-5410 Spring Cloud Config

Affected softwareSpring Cloud Config
Severity7.5 High CVSS 3.1 3 scores
Fixed in2.1.9, 2.2.3
WeaknessRelative path traversal (CWE-23)
Published2 Jun 2020
Updated17 Jun 2026

Description

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.

CWE-22 · Path traversal

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-03-25 · remediation due 2022-04-15 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 8 citations · 3 exploits · earliest 2022-01-12.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: partial.
  • Indexed PoC 2 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2020-06-03.
  • EPSS 96% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2020-5410 in VulnCheck (free account), which lists 3 more citations not shown here.

EvidenceSourceDetailDate
Reported exploitation blog.checkpoint.com /security/december-2021s-most-wanted-malware-trickbot-emotet-and-the-log4j-plague 2022-01-12
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2022-03-25
Reported exploitation blog.checkpoint.com /security/april-2022s-most-wanted-malware-a-shake-up-in-the-index-but-emotet-is-still-on-top 2022-05-11
Reported exploitation blog.checkpoint.com /security/april-2024s-most-wanted-malware-surge-in-androxgh0st-attacks-and-the-decline-of-lockbit3 2024-05-09
Reported exploitation blog.checkpoint.com /research/may-2024s-most-wanted-malware-phorpiex-botnet-unleashes-phishing-frenzy-while-lockbit3-dominates-once-again 2024-06-10
Exploit reference VulnCheck XDB e1abb7641447 Exploit type: infoleak 2021-09-08
Exploit reference VulnCheck XDB 788a7241c9c9 Exploit type: infoleak 2023-12-21
Exploit reference VulnCheck XDB 6eac00f6b406 Exploit type: infoleak 2025-01-21

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC CVE-2020-5410 2020-06-03
Nuclei Spring Cloud Config Server - Local File Inclusion

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A vulnerability class already blocked by an ARMR security rule
Finding Protected by Waratek's ARMR path-traversal security rule, which blocks this class of attack at the JVM level without a rule written for this CVE specifically. The CVE's weakness is CWE-23: Relative Path Traversal.

How to mitigate CVE-2020-5410

Upgrade Spring Cloud Config to a release that fixes it: 2.1.9 or 2.2.3. Until you can, Waratek RASP blocks exploitation with its path traversal rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N NVD Primary published
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CISA-ADP Secondary
CVSS 2.0 5.0 none AV:N/AC:L/Au:N/C:P/I:N/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update January 2024 ↗ CPU 2024-Q1 Oracle Financial Services Applications / Common (Spring Cloud Config) (14.5.0-14.7.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Financial Services Applications Common (Spring Cloud Config) 14.5.0-14.7.0

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.springframework.cloud:spring-cloud-config-server 2.1.0 2.1.9 unbounded
org.springframework.cloud:spring-cloud-config-server 2.2.0 2.2.3 unbounded

Products and versions

2 products, 4 version entries
SourceVendorProductSchemeAffected versions
osv org.springframework.cloud spring-cloud-config-server generic ≥ 2.1.0 and ＜ 2.1.9 · ≥ 2.2.0 and ＜ 2.2.3
nvd vmware spring cloud config generic ≥ 2.1.0 and ＜ 2.1.9 · ≥ 2.2.0 and ＜ 2.2.3

References

URLTags
https://github.com/spring-cloud/spring-cloud-config PACKAGE
https://tanzu.vmware.com/security/cve-2020-5410 WEB
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5410 WEB

Timeline
Published2020-06-02By the CVE Program.
VulnCheck KEV: earliest evidence2022-01-12Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2022-03-25Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: latest evidence2025-01-21Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-17NVD's own last-modified date for this record.