CVE-2020-5405

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-23 CWE-22

Affected software

Vendor	Product	Versions
Spring by VMware	Spring Cloud Config	>= 2.2, < 2.2.2; >= 2.1, < 2.1.7

References

https://pivotal.io/security/cve-2020-5405Vendor Advisory
https://pivotal.io/security/cve-2020-5405Vendor Advisory

Timeline

Published: Mar 5, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-54066.5VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5,CVE-2020-54078.8Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response valid CVE-2020-54086.5Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 CVE-2020-54096.1Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker CVE-2020-54107.5Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serv CVE-2020-54118.1When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jac CVE-2020-54126.5Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use CVE-2020-54139.8Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with CVE-2020-54145.7VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7)CVE-2020-541510.0Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by wa CVE-2020-54166.5Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters,CVE-2020-54178.8Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (wh