CVE-2020-5405

MEDIUM NUCLEI

Spring Cloud Config <2.2.2 & <2.1.7 - Path Traversal

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-5405. PoCs published by shoucheng3. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains the source code for Spring Cloud Config, specifically the 2.1.6.RELEASE version, which is vulnerable to CVE-2020-5405. The vulnerability involves improper path sanitization leading to directory traversal, allowing attackers to access sensitive files.

Description

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.

Exploits (1)

nomisec WRITEUP
by shoucheng3 · poc
https://github.com/shoucheng3/spring-cloud__spring-cloud-config_CVE-2020-5405_2-1-6-RELEASE

This repository contains the source code for Spring Cloud Config, specifically the 2.1.6.RELEASE version, which is vulnerable to CVE-2020-5405. The vulnerability involves improper path sanitization leading to directory traversal, allowing attackers to access sensitive files.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Spring Cloud Config 2.1.6.RELEASE
No auth needed
Prerequisites: Access to the Spring Cloud Config server endpoint
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Nuclei Templates (1)

Spring Cloud Config - Local File Inclusion
MEDIUMby harshbothra_

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://pivotal.io/security/cve-2020-5405

Scores

CVSS v3 6.5
EPSS 0.6876
EPSS Percentile 99.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Details

CWE
CWE-22 CWE-23
Status published
Products (2)
org.springframework.cloud/spring-cloud-config-server 2.1.0 - 2.1.7Maven
vmware/spring_cloud_config 2.1.0 - 2.1.7
Published Mar 05, 2020
Tracked Since Feb 18, 2026