What is the CVSS score of CVE-2019-3799?

CVE-2019-3799 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 85.3%.

Is there a public PoC exploit available for CVE-2019-3799?

Yes, a public proof-of-concept exploit is available for CVE-2019-3799. Prioritise patching immediately. EPSS: 85.3%.

Is there a patch available for CVE-2019-3799?

Yes, a patch is available for CVE-2019-3799. Update the affected software to the latest version immediately.

Spring Cloud Config CVE-2019-3799

MEDIUM

Path Traversal (CWE-22)

2019-05-06 security_alert@emc.com

Java Path Traversal Oracle VMware Communications Cloud Native Core Policy Spring Cloud Config

6.5

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-22 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling Path canonicalization, traversal prevention MITRE ATT&CK 2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS score of 6.5 (MEDIUM). Attack characteristics: network attack vector, low complexity, no privileges required, user interaction required.
Exploit ScenarioDerived	A remote attacker could access files and directories outside the intended path by sending crafted requests to the affected application. No authentication is required to exploit this vulnerability.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 85.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.

Affected Packages

maven org.springframework.cloud:spring-cloud-config-server fix: 1.4.6, 2.0.4, 2.1.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in maven

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack. Affected products include: Vmware Spring Cloud Config, Oracle Communications Cloud Native Core Policy. Version information: prior to 2.1.2.

Know when Spring Cloud Config gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

DescriptionNVD

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.

Threat Intelligence Overview

EPSS Score

85.3%

Top 0% exploitable

Exploit

POC

Public exploit code exists

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS POC (2)

Exploit-DB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 85.3%

Patch available Yes

Active threat Yes

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

Medium

Priority Score

137

Low Medium High Critical

KEV: 0

EPSS: +85

CVSS: +32

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

Affected Products (CPE)NVD

cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*

More in Spring Cloud Config

View all

CVE-2020-5410 HIGH This Week POC

7.5 Jun 02

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow

CVE-2020-5405 MEDIUM This Month POC

6.5 Mar 05

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow

CVE-2026-40982 CRITICAL Act Now

9.1 May 07

Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files

CVE-2026-47836 HIGH This Week

8.1 Aug 26

Time-of-check-time-of-use (TOCTOU) race condition in Spring Cloud Config Server's SVN backend allows unauthenticated net

CVE-2026-41002 HIGH This Week

8.1 May 07

Time-of-check-to-time-of-use race in Spring Cloud Config Server's Git clone base directory (spring.cloud.config.server.g

CVE-2026-47894 HIGH This Week

7.5 Aug 27

Path traversal in Spring Cloud Config Server's native environment repository allows unauthenticated remote attackers to

CVE-2026-40981 HIGH This Week

7.5 May 07

Remote unauthenticated attackers can access Google Secrets Manager credentials from unintended GCP projects via crafted

CVE-2026-47837 CRITICAL Act Now

9.8 Aug 26

Missing authentication on Spring Cloud Config Server's /monitor endpoint lets remote attackers submit unvalidated webhoo

CVE-2023-20859 MEDIUM This Month

5.5 Mar 23

In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is v

CVE-2026-59315 MEDIUM This Month

5.3 Aug 27

Denial of Service in Spring Cloud Config's Monitor component allows unauthenticated remote attackers to crash or degrade

CVE-2026-41004 MEDIUM This Month

4.4 May 07

Spring Cloud Config Server exposes sensitive information in plaintext logs when trace logging is enabled, allowing high-

Same weakness CWE-22 – Path Traversal

View all

CVE-2019-3396 CRITICAL POC

9.8

CVE-2019-19781 CRITICAL POC

9.8

CVE-2020-5902 CRITICAL POC

9.8

CVE-2021-21972 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2022-41352 CRITICAL POC

9.8

CVE-2021-27065 HIGH POC

7.8

CVE-2019-11510 CRITICAL POC

10.0

Same technique Path Traversal

View all

CVE-2018-20250 HIGH POC

7.8

CVE-2022-37042 CRITICAL POC

9.8

CVE-2025-64446 CRITICAL POC

9.8

References

Advisories & patches

PATCH https://www.oracle.com/security-alerts/cpuapr2022.html ADVISORY https://pivotal.io/security/cve-2019-3799

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back