Vulnerability record · CVE-2020-5405 · published 5 March 2020
CVE-2020-5405: Spring Cloud Config Server path traversal in config file serving
Vmware · Spring Cloud Config
Spring Cloud Config Server versions 2.2.x before 2.2.2, 2.1.x before 2.1.7, and older unsupported releases can be made to serve arbitrary configuration files via a specially crafted URL, resulting in a directory traversal. Because config servers often hold credentials and environment secrets, exposure of files outside the intended config directory is a serious confidentiality risk.
Description
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Automated analysis
high priorityThe flaw allows unauthenticated network-reachable file disclosure from a secrets-bearing service, and EPSS is very high despite no KEV listing.
What it is
Spring Cloud Config Server versions 2.2.x before 2.2.2, 2.1.x before 2.1.7, and older unsupported releases can be made to serve arbitrary configuration files via a specially crafted URL, resulting in a directory traversal. Because config servers often hold credentials and environment secrets, exposure of files outside the intended config directory is a serious confidentiality risk.
Impact
An attacker can read arbitrary files reachable by the config server process, potentially exposing configuration data, credentials, or other sensitive files on the host. The CVSS vector shows high integrity impact with no confidentiality impact recorded, which is inconsistent with a file disclosure flaw and should be treated cautiously.
Attack surface
Reachable over the network via HTTP requests to the spring-cloud-config-server module; no authentication is required per the vector, but user interaction is marked as required, which is unusual for a server-side traversal and may reflect a client-side or redirect-based path.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged beyond the vendor advisory, but EPSS is very high at roughly 0.69 (99.3rd percentile), indicating substantial predicted exploitation activity.
What to do
- Upgrade Spring Cloud Config Server to 2.2.2, 2.1.7, or a later supported release.
- Restrict network access to the config server so only trusted clients and networks can reach it.
- Run the config server with least privilege and limit filesystem paths readable by its process.
- Audit configuration repositories for secrets and rotate any credentials that may have been exposed.
Detection
- Monitor config server access logs for URLs containing traversal sequences such as ../ or encoded variants.
- Alert on requests for files outside the expected config directory or repository paths.
- Review outbound or file-read behavior of the config server process for unexpected file access.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://pivotal.io/security/cve-2020-5405 | Vendor Advisory |
| https://pivotal.io/security/cve-2020-5405 | Vendor Advisory |
Track CVE-2020-5405 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-5405), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
