PT-2020-18461
CVE-2020-5405
·
تاريخ النشر
2020-03-05
·
تاريخ التحديث
2020-06-05
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Spring Cloud Config versions 2.2.x prior to 2.2.2
Spring Cloud Config versions 2.1.x prior to 2.1.7
Spring Cloud Config older unsupported versions
Description
The issue allows applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.
Recommendations
For Spring Cloud Config versions 2.2.x prior to 2.2.2, update to version 2.2.2 or later.
For Spring Cloud Config versions 2.1.x prior to 2.1.7, update to version 2.1.7 or later.
For Spring Cloud Config older unsupported versions, consider upgrading to a supported version to mitigate the risk.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾