CVE-2019-3799CWE-22

Directory Traversal with spring-cloud-config-server

published May 6, 2019

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.7th percentile for exploit probability.

CVSS
—
EPSS
85%
Percentile
99.7
In the wild
Unconfirmed
What it is

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.85295 · 99.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2019-05-06T15:21Z
EPSS history
Timeline
  • 06 MAY 15:21Z
    Directory Traversal with spring-cloud-config-server
    cvelistv5