Live › vulnerability › CVE-2020-5410
Go to dashboardVMware Tanzu Spring Cloud Config Server has a path traversal flaw that lets requests read arbitrary configuration files on the server. An attacker can pull secrets such as credentials and keys stored in those files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| VMware Tanzu Spring Cloud Configuration (Config) Server | vendor | – | – |
Unknown from the sources.
Apply the update per VMware's vendor instructions; the sources do not name the fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
This page as .md · .json · in your agent: get_signal("CVE-2020-5410")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.