Spring Cloud Config
Monthly
Path traversal in Spring Cloud Config Server's native environment repository allows unauthenticated remote attackers to read arbitrary files outside the configured search-locations directory on the server filesystem. Affected deployments span four release lines - 3.1.14 and earlier, 4.0.0-4.2.8, 4.3.0-4.3.4, and 5.0.0-5.0.4 - and are limited to the native filesystem backend mode. No public exploit code has been identified and CISA KEV does not list this vulnerability, though the centralized role of Config Server as a secrets store elevates real-world impact beyond the raw EPSS percentile.
Missing authentication on Spring Cloud Config Server's /monitor endpoint lets remote attackers submit unvalidated webhook requests, forcing configuration-refresh events without any credentials. It affects Spring Cloud Config 3.x through 3.1.14, 4.0.0-4.2.8, 4.3.0-4.3.4, and 5.0.0-5.0.4, and is exploitable only when the spring-cloud-config-monitor component is enabled. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile) and CISA SSVC rates exploitation as none and technical impact as only partial, tempering the vendor's 9.8 rating.
Time-of-check-time-of-use (TOCTOU) race condition in Spring Cloud Config Server's SVN backend allows unauthenticated network attackers to manipulate the basedir path between validation and use, achieving full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). Affected are all branches of Spring Cloud Config through 5.0.4, 4.3.4, 4.2.8, and 3.1.14 and earlier, covering a broad range of enterprise Spring microservices deployments. No public exploit code has been identified and no active exploitation is confirmed; however, the vendor (VMware/Spring) has released patches across all affected branches.
Remote unauthenticated attackers can access Google Secrets Manager credentials from unintended GCP projects via crafted requests to Spring Cloud Config servers using Google Secrets Manager as a backend. VMware confirmed this high-severity information disclosure vulnerability (CVSS 7.5) affecting all 3.1.x through 5.0.x versions. No CISA KEV listing or public exploit code identified at time of analysis, but the network-accessible attack vector with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N) indicates straightforward exploitation once attackers identify vulnerable Spring Cloud Config deployments with Google Secrets Manager integration.
Time-of-check-time-of-use (TOCTOU) race condition in Spring Cloud Config Server's Git repository cloning mechanism allows local privileged attackers with high-privilege system access to potentially read or modify configuration data intended for other applications. Exploitation requires timing manipulation of the basedir filesystem path between validation and use, enabling symlink attacks or directory substitution. CVSS 7.2 reflects high attack complexity (AC:H) and privileged local access (AV:L/PR:H) requirements, but scope change (S:C) indicates impact beyond the vulnerable component. EPSS data not available; no public exploit identified at time of analysis.
Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files from the file system using specially crafted URLs. Affects Spring Cloud Config versions 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, and 5.0.0-5.0.2, with patches available across all branches. The vulnerability achieves CVSS 9.1 (Critical) due to remote exploitation without authentication (AV:N/AC:L/PR:N/UI:N) and high confidentiality/integrity impact, though EPSS and KEV data are not available to confirm active exploitation status. VMware/Spring has released fixes for all affected versions.
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Denial of Service in Spring Cloud Config's Monitor component allows unauthenticated remote attackers to crash or degrade the configuration server by submitting malicious payloads to the webhook endpoint. Affected versions span the 3.x, 4.x, and 5.x release lines, covering a broad installed base of Spring Boot microservice environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the unauthenticated network-accessible attack surface (PR:N, AV:N, AC:L) means exploitation requires minimal capability.
Spring Cloud Config Server exposes sensitive information in plaintext logs when trace logging is enabled, allowing high-privilege local users to access configuration data including credentials and API keys. The vulnerability affects versions 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, and 5.0.0-5.0.2. No public exploit identified at time of analysis; vendor-released patches are available for all affected version lines.
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Path traversal in Spring Cloud Config Server's native environment repository allows unauthenticated remote attackers to read arbitrary files outside the configured search-locations directory on the server filesystem. Affected deployments span four release lines - 3.1.14 and earlier, 4.0.0-4.2.8, 4.3.0-4.3.4, and 5.0.0-5.0.4 - and are limited to the native filesystem backend mode. No public exploit code has been identified and CISA KEV does not list this vulnerability, though the centralized role of Config Server as a secrets store elevates real-world impact beyond the raw EPSS percentile.
Missing authentication on Spring Cloud Config Server's /monitor endpoint lets remote attackers submit unvalidated webhook requests, forcing configuration-refresh events without any credentials. It affects Spring Cloud Config 3.x through 3.1.14, 4.0.0-4.2.8, 4.3.0-4.3.4, and 5.0.0-5.0.4, and is exploitable only when the spring-cloud-config-monitor component is enabled. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile) and CISA SSVC rates exploitation as none and technical impact as only partial, tempering the vendor's 9.8 rating.
Time-of-check-time-of-use (TOCTOU) race condition in Spring Cloud Config Server's SVN backend allows unauthenticated network attackers to manipulate the basedir path between validation and use, achieving full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). Affected are all branches of Spring Cloud Config through 5.0.4, 4.3.4, 4.2.8, and 3.1.14 and earlier, covering a broad range of enterprise Spring microservices deployments. No public exploit code has been identified and no active exploitation is confirmed; however, the vendor (VMware/Spring) has released patches across all affected branches.
Remote unauthenticated attackers can access Google Secrets Manager credentials from unintended GCP projects via crafted requests to Spring Cloud Config servers using Google Secrets Manager as a backend. VMware confirmed this high-severity information disclosure vulnerability (CVSS 7.5) affecting all 3.1.x through 5.0.x versions. No CISA KEV listing or public exploit code identified at time of analysis, but the network-accessible attack vector with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N) indicates straightforward exploitation once attackers identify vulnerable Spring Cloud Config deployments with Google Secrets Manager integration.
Time-of-check-time-of-use (TOCTOU) race condition in Spring Cloud Config Server's Git repository cloning mechanism allows local privileged attackers with high-privilege system access to potentially read or modify configuration data intended for other applications. Exploitation requires timing manipulation of the basedir filesystem path between validation and use, enabling symlink attacks or directory substitution. CVSS 7.2 reflects high attack complexity (AC:H) and privileged local access (AV:L/PR:H) requirements, but scope change (S:C) indicates impact beyond the vulnerable component. EPSS data not available; no public exploit identified at time of analysis.
Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files from the file system using specially crafted URLs. Affects Spring Cloud Config versions 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, and 5.0.0-5.0.2, with patches available across all branches. The vulnerability achieves CVSS 9.1 (Critical) due to remote exploitation without authentication (AV:N/AC:L/PR:N/UI:N) and high confidentiality/integrity impact, though EPSS and KEV data are not available to confirm active exploitation status. VMware/Spring has released fixes for all affected versions.
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Denial of Service in Spring Cloud Config's Monitor component allows unauthenticated remote attackers to crash or degrade the configuration server by submitting malicious payloads to the webhook endpoint. Affected versions span the 3.x, 4.x, and 5.x release lines, covering a broad installed base of Spring Boot microservice environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the unauthenticated network-accessible attack surface (PR:N, AV:N, AC:L) means exploitation requires minimal capability.
Spring Cloud Config Server exposes sensitive information in plaintext logs when trace logging is enabled, allowing high-privilege local users to access configuration data including credentials and API keys. The vulnerability affects versions 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, and 5.0.0-5.0.2. No public exploit identified at time of analysis; vendor-released patches are available for all affected version lines.
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.