Nguyen Van Hiep

**Name of the Vulnerable Software and Affected Versions** Spring Cloud Config versions 5.0.0 through 5.0.4 Spring Cloud Config versions 4.3.0 through 4.3.4 Spring Cloud Config versions 4.0.0 through 4.2.8 Spring Cloud Config versions 3.1.14 and earlier **Description** The native environment repository in Spring Cloud Config Server allows the exposure of configuration files located outside of the configured repository path. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Spring Cloud Function versions 5.0.0 through 5.0.3 Spring Cloud Function versions 4.3.0 through 4.3.4 Spring Cloud Function versions 4.2.0 through 4.2.7 **Description** An issue exists that may allow arbitrary file read and Server-Side Request Forgery (SSRF), a technique where an attacker induces a server-side application to make requests to an unintended location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.