Spring Cloud Config
Monthly
Denial of Service in Spring Cloud Config's Monitor component allows unauthenticated remote attackers to crash or degrade the configuration server by submitting malicious payloads to the webhook endpoint. Affected versions span the 3.x, 4.x, and 5.x release lines, covering a broad installed base of Spring Boot microservice environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the unauthenticated network-accessible attack surface (PR:N, AV:N, AC:L) means exploitation requires minimal capability.
Unauthenticated webhook requests can be sent to Spring Cloud Config Server's /monitor endpoint due to missing validation of incoming webhook payloads, enabling any network-accessible attacker to trigger configuration refresh events across connected microservices. Affected are all branches including 3.x through 3.1.14, 4.0.x through 4.2.8, 4.3.x through 4.3.4, and 5.0.x through 5.0.4 - a broad spread across major release lines. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the network-accessible, authentication-free nature of the flaw lowers the exploitation bar considerably for attackers who can reach the config server.
Spring Cloud Config Server's SVN backend is vulnerable to time-of-check-time-of-use (TOCTOU) race conditions on the local base directory (spring.cloud.config.server.svn.basedir) used to clone SVN repositories. An attacker with local high-privilege access can manipulate the directory - for example, by substituting a symlink - between the check and use phases, potentially gaining unauthorized read or write access to configuration data served to downstream microservices. The CVSS scope-change metric (S:C) indicates that successful exploitation can cascade beyond the Config Server itself, affecting applications that consume the tampered configuration. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote unauthenticated attackers can access Google Secrets Manager credentials from unintended GCP projects via crafted requests to Spring Cloud Config servers using Google Secrets Manager as a backend. VMware confirmed this high-severity information disclosure vulnerability (CVSS 7.5) affecting all 3.1.x through 5.0.x versions. No CISA KEV listing or public exploit code identified at time of analysis, but the network-accessible attack vector with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N) indicates straightforward exploitation once attackers identify vulnerable Spring Cloud Config deployments with Google Secrets Manager integration.
Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files from the file system using specially crafted URLs. Affects Spring Cloud Config versions 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, and 5.0.0-5.0.2, with patches available across all branches. The vulnerability achieves CVSS 9.1 (Critical) due to remote exploitation without authentication (AV:N/AC:L/PR:N/UI:N) and high confidentiality/integrity impact, though EPSS and KEV data are not available to confirm active exploitation status. VMware/Spring has released fixes for all affected versions.
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Denial of Service in Spring Cloud Config's Monitor component allows unauthenticated remote attackers to crash or degrade the configuration server by submitting malicious payloads to the webhook endpoint. Affected versions span the 3.x, 4.x, and 5.x release lines, covering a broad installed base of Spring Boot microservice environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the unauthenticated network-accessible attack surface (PR:N, AV:N, AC:L) means exploitation requires minimal capability.
Unauthenticated webhook requests can be sent to Spring Cloud Config Server's /monitor endpoint due to missing validation of incoming webhook payloads, enabling any network-accessible attacker to trigger configuration refresh events across connected microservices. Affected are all branches including 3.x through 3.1.14, 4.0.x through 4.2.8, 4.3.x through 4.3.4, and 5.0.x through 5.0.4 - a broad spread across major release lines. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the network-accessible, authentication-free nature of the flaw lowers the exploitation bar considerably for attackers who can reach the config server.
Spring Cloud Config Server's SVN backend is vulnerable to time-of-check-time-of-use (TOCTOU) race conditions on the local base directory (spring.cloud.config.server.svn.basedir) used to clone SVN repositories. An attacker with local high-privilege access can manipulate the directory - for example, by substituting a symlink - between the check and use phases, potentially gaining unauthorized read or write access to configuration data served to downstream microservices. The CVSS scope-change metric (S:C) indicates that successful exploitation can cascade beyond the Config Server itself, affecting applications that consume the tampered configuration. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote unauthenticated attackers can access Google Secrets Manager credentials from unintended GCP projects via crafted requests to Spring Cloud Config servers using Google Secrets Manager as a backend. VMware confirmed this high-severity information disclosure vulnerability (CVSS 7.5) affecting all 3.1.x through 5.0.x versions. No CISA KEV listing or public exploit code identified at time of analysis, but the network-accessible attack vector with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N) indicates straightforward exploitation once attackers identify vulnerable Spring Cloud Config deployments with Google Secrets Manager integration.
Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files from the file system using specially crafted URLs. Affects Spring Cloud Config versions 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, and 5.0.0-5.0.2, with patches available across all branches. The vulnerability achieves CVSS 9.1 (Critical) due to remote exploitation without authentication (AV:N/AC:L/PR:N/UI:N) and high confidentiality/integrity impact, though EPSS and KEV data are not available to confirm active exploitation status. VMware/Spring has released fixes for all affected versions.
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.