org.springframework.cloud vulnerabilities

Products

• org.springframework.cloud/spring-cloud-config-server 8
• org.springframework.cloud/spring-cloud-function-context 4
• org.springframework.cloud/spring-cloud-gateway 3
• org.springframework.cloud/spring-cloud-gateway-server 2
• org.springframework.cloud/spring-cloud-contract-shade 1
• org.springframework.cloud/spring-cloud-function-parent 1
• org.springframework.cloud/spring-cloud-gateway-server-mvc 1
• org.springframework.cloud/spring-cloud-gateway-server-webflux 1
• org.springframework.cloud/spring-cloud-netflix 1
• org.springframework.cloud/spring-cloud-netflix-hystrix-dashboard 1
• org.springframework.cloud/spring-cloud-netflix-zuul 1
• org.springframework.cloud/spring-cloud-openfeign-core 1
• org.springframework.cloud/spring-cloud-skipper 1
• org.springframework.cloud/spring-cloud-sleuth-instrumentation 1
• org.springframework.cloud/spring-cloud-task-dependencies 1

Latest org.springframework.cloud CVEs

Newest publication first · page 2 of 2

1. CVE-2020-5405 Directory Traversal with spring-cloud-config-server

   Published 2020-03-05

   Medium·CVSS 6.5 EPSS 68.5%

   Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a spe...

2. CVE-2019-3799 Directory Traversal with spring-cloud-config-server

   Published 2019-05-06

   Medium·CVSS 6.5 EPSS 85.3% Public exploit PoC

   Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attac...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.