Spring Cloud Config Directory Traversal Vulnerability in Config Server Module

A directory traversal vulnerability has been identified in the Spring Cloud Config Server module, allowing attackers to access arbitrary text and binary files. This issue affects Spring Cloud Config versions 3.1.0 through 3.1.13, 4.1.0 through 4.1.9, 4.2.0 through 4.2.6, 4.3.0 through 4.3.2, and 5.0.0 through 5.0.2. Older, unsupported versions are also affected.

Impact

Exploitation of this vulnerability allows for directory traversal, enabling attackers to access files outside the intended directory.

Remediation

Users should upgrade to Spring Cloud Config version 3.1.14, 4.1.10, 4.2.7, 4.3.3, or 5.0.3, depending on their current version. Versions 4.3.3 and 5.0.3 are available as open-source, while the other mentioned versions are for enterprise support only.