CVE-2020-5405

Name of the Vulnerable Software and Affected Versions Spring Cloud Config versions 2.2.x prior to 2.2.2 Spring Cloud Config versions 2.1.x prior to 2.1.7 Spring Cloud Config older unsupported versions

Description The issue allows applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.

Recommendations For Spring Cloud Config versions 2.2.x prior to 2.2.2, update to version 2.2.2 or later. For Spring Cloud Config versions 2.1.x prior to 2.1.7, update to version 2.1.7 or later. For Spring Cloud Config older unsupported versions, consider upgrading to a supported version to mitigate the risk.