Directory traversal attack in Spring Cloud Config
Moderate severity
GitHub Reviewed
Published
Jun 5, 2020
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Package
Affected versions
>= 2.1.0, < 2.1.7
>= 2.2.0, < 2.2.2
Patched versions
2.1.7
2.2.2
Description
Published by the National Vulnerability Database
Mar 5, 2020
Reviewed
Jun 4, 2020
Published to the GitHub Advisory Database
Jun 5, 2020
Last updated
Feb 1, 2023
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
References