CVE-2020-5410

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-23 CWE-22

Affected software

Vendor	Product	Versions
Spring by VMware	Spring Cloud Config	>= 2.1, < 2.1.9; >= 2.2, < 2.2.3

References

https://tanzu.vmware.com/security/cve-2020-5410Vendor Advisory
https://tanzu.vmware.com/security/cve-2020-5410Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5410US Government Resource

Timeline

Published: Jun 2, 2020
Last modified: Jun 17, 2026
Added to CISA KEV: Mar 25, 2022
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-54118.1When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jac CVE-2020-54126.5Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use CVE-2020-54139.8Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with CVE-2020-54145.7VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7)CVE-2020-541510.0Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by wa CVE-2020-54166.5Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters,CVE-2020-54178.8Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (wh CVE-2020-54184.3Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but CVE-2020-54196.7RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code CVE-2020-54207.7Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to t CVE-2020-54216.5In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections CVE-2020-54226.5BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed