- Vendor / Project
- VMware Tanzu
- Product
- Spring Cloud Configuration (Config) Server
- Date added
- Mar 25, 2022
- Due date
- Apr 15, 2022
- Known ransomware use
- Unknown
- CWEs
- CWE-23
Description
Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files.
Required action
Apply updates per vendor instructions.