CVE-2020-5410
Published 2020-06-02 · Updated 2026-06-17 · Source security@pivotal.io
Summary
CVE-2020-5410 is a high-severity (CVSS 7.5) vulnerability in VMware Tanzu Spring Cloud Configuration (Config) Server. CISA added it to the Known Exploited Vulnerabilities catalog on March 25, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 15, 2022. CISA does not currently list it as used in ransomware campaigns. VMware Tanzu has 3 vulnerabilities in the KEV catalog, 1 of them linked to ransomware.
All 3 known-exploited VMware Tanzu vulnerabilities →Description
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA Known-Exploited Vulnerability
Product: VMware Tanzu — Spring Cloud Configuration (Config) Server
Name: VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
Date added: 2022-03-25 · Due: 2022-04-15
Required action: Apply updates per vendor instructions.