Homepage

org.springframework.cloud:spring-cloud-config-server@2.2.3.RELEASE vulnerabilities

  • latest version

    4.3.0

  • latest non vulnerable version

    5.0.0-M3

  • first published

    10 years ago

  • latest version published

    5 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.springframework.cloud:spring-cloud-config-server package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Improper Authorization

    org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration.

    Affected versions of this package are vulnerable to Improper Authorization due to not using the Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault.

    Note:

    This is only exploitable if all of the following conditions are met:

    1. You have Spring Vault on the classpath of your Spring Cloud Config Server;

    2. You are using the X-CONFIG-TOKEN header to send a Vault token to the Spring Cloud Config Server for the Config Server to use when making requests to Vault;

    3. You are using the default Spring Vault SessionManager implementation LifecycleAwareSessionManager or a SessionManager implementation that persists the Vault token such as SimpleSessionManager.

    How to fix Improper Authorization?

    Upgrade org.springframework.cloud:spring-cloud-config-server to version 3.1.10, 4.1.6, 4.2.2 or higher.

    [2.2.0,3.1.10)[4.0.0,4.1.6)[4.2.0,4.2.2)
    Go back to all versions of this package