{"action":"Upgrade org.springframework.cloud:spring-cloud-config-server to 2.1.7 (2.1.x) or 2.2.2 (2.2.x) or later.","affected":[{"fixed":"2.1.7","introduced":"2.1.0"},{"fixed":"2.2.2","introduced":"2.2.0"}],"component":"org.springframework.cloud:spring-cloud-config-server","cve_ids":["CVE-2020-5405"],"ecosystem":"Maven","epss":0.68542,"exploited":false,"fixed_versions":["2.1.7","2.2.2"],"ghsa_id":"GHSA-g86w-v5vg-9gxf","id":"tcs_01M5N8XQPKB7VRH2WEHPE8B6FE","modified_at":"2023-11-08T04:03:55.163505Z","published_at":"2020-06-05T16:11:36Z","references":["https://osv.dev/vulnerability/GHSA-g86w-v5vg-9gxf","https://nvd.nist.gov/vuln/detail/CVE-2020-5405","https://github.com/spring-cloud/spring-cloud-config/spring-cloud-config-server","https://pivotal.io/security/cve-2020-5405"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-g86w-v5vg-9gxf","url":"https://osv.dev/vulnerability/GHSA-g86w-v5vg-9gxf"}],"summary":"Directory traversal attack in Spring Cloud Config"}