Description
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring by VMware | Spring Cloud Config | 2.1 – < 2.1.9, 2.2 – < 2.2.3 | 2.1.9 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Directory Traversal in Spring Cloud Config Server
auxiliary/scanner/http/springcloud_directory_traversal
GitHub 2 repositories
-
shoucheng3/spring-cloud__spring-cloud-config_CVE-2020-5410_2-1-8-RELEASE ★ 0 · Aug 17, 2025
-
dead5nd/config-demo ★ 0 · Jun 3, 2020
CVE-2020-5410
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Spring Cloud Config Server - Local File Inclusion http/cves/2020/CVE-2020-5410.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-config-server | >= 2.1.0, < 2.1.9 | 2.1.9 | GHSA-32xf-jwmv-9hf3 |
| Maven | org.springframework.cloud:spring-cloud-config-server | >= 2.2.0, < 2.2.3 | 2.2.3 | GHSA-32xf-jwmv-9hf3 |
Advisories 1
- WID-SEC-2024-0124 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024