Spring Cloud
Monthly
Improper authentication handling in Spring Cloud Azure (versions 1.0.0 through releases before 7.4.0) allows an unauthenticated remote attacker to bypass authentication logic and elevate privileges within a Java application that embeds the library, yielding high confidentiality, integrity, and availability impact on the affected component and its Azure-connected resources. The 8.1 CVSS rating is moderated by a High attack-complexity metric, meaning the bypass hinges on a specific, non-trivial condition or configuration the attacker must satisfy rather than a single trivial request. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score is low at 0.64 percent (49th percentile), so the risk is driven by exposure of vulnerable deployments rather than observed attack activity.
Spring Cloud Config Server contains a path traversal vulnerability when using the native file system backend, allowing unauthenticated remote attackers to access arbitrary files outside configured search directories by manipulating the profile parameter in requests. This affects Spring Cloud versions 3.1.X before 3.1.13, 4.1.X before 4.1.9, 4.2.X before 4.2.3, 4.3.X before 4.3.2, and 5.0.X before 5.0.2. With a CVSS score of 8.6 indicating high confidentiality impact with some integrity and availability impact, and network-based attack vector requiring no authentication, this represents a significant information disclosure risk for exposed Config Server instances.
Improper authentication handling in Spring Cloud Azure (versions 1.0.0 through releases before 7.4.0) allows an unauthenticated remote attacker to bypass authentication logic and elevate privileges within a Java application that embeds the library, yielding high confidentiality, integrity, and availability impact on the affected component and its Azure-connected resources. The 8.1 CVSS rating is moderated by a High attack-complexity metric, meaning the bypass hinges on a specific, non-trivial condition or configuration the attacker must satisfy rather than a single trivial request. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score is low at 0.64 percent (49th percentile), so the risk is driven by exposure of vulnerable deployments rather than observed attack activity.
Spring Cloud Config Server contains a path traversal vulnerability when using the native file system backend, allowing unauthenticated remote attackers to access arbitrary files outside configured search directories by manipulating the profile parameter in requests. This affects Spring Cloud versions 3.1.X before 3.1.13, 4.1.X before 4.1.9, 4.2.X before 4.2.3, 4.3.X before 4.3.2, and 5.0.X before 5.0.2. With a CVSS score of 8.6 indicating high confidentiality impact with some integrity and availability impact, and network-based attack vector requiring no authentication, this represents a significant information disclosure risk for exposed Config Server instances.