CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Affected products
vmware: spring cloud config
References3
- tanzu.vmware.com/security/cve-2020-5410 Vendor Advisory
- tanzu.vmware.com/security/cve-2020-5410 Vendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=… US Government Resource
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS — exploit probability
- 96% percentile: 100 · as of 2 November 2026
- CWE
- CWE-23CWE-22