{
  "@id": "urn:uuid:51df6ff3-a224-4e8b-8b74-019969de27e7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T13:17:00.220923+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T13:12:30.880945+00:00",
      "status_notes": "Vulnerability CVE-2019-3799 does not affect version 3.1.10-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. not_affected \u2014 CVE-2019-3799 directory traversal vulnerability is NOT present in spring-cloud-config 3.1.10. The target contains path validation logic (PathUtils.isInvalidPath() and isInvalidEncodedPath()) that blocks directory traversal attacks including URL-encoded variants. This fix was introduced by upstream commit 1c01d11b (March 17, 2020) by Spencer Gibb and shipped in the upstream release 3.1.10 that T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3799"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3799 directory traversal vulnerability is NOT present in spring-cloud-config 3.1.10. The target contains path validation logic (PathUtils.isInvalidPath() and isInvalidEncodedPath()) that blocks directory traversal attacks including URL-encoded variants. This fix was introduced by upstream commit 1c01d11b (March 17, 2020) by Spencer Gibb and shipped in the upstream release 3.1.10 that T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T13:12:30.880945+00:00",
      "status_notes": "Vulnerability CVE-2020-5405 does not affect version 3.1.10-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. not_affected \u2014 CVE-2020-5405 (directory traversal in Spring Cloud Config) is NOT present in version 3.1.10. The upstream fix (commit 651f458919c40ef9a5e93e7d76bf98575910fad0 by Spencer Gibb, Feb 2020) was already included in the Spring Cloud Config 3.1.10 release that TuxCare onboarded. The target implements multi-layered directory traversal defenses: (1) ResourceController.normalize() validates all path vari...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5405"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5405 (directory traversal in Spring Cloud Config) is NOT present in version 3.1.10. The upstream fix (commit 651f458919c40ef9a5e93e7d76bf98575910fad0 by Spencer Gibb, Feb 2020) was already included in the Spring Cloud Config 3.1.10 release that TuxCare onboarded. The target implements multi-layered directory traversal defenses: (1) ResourceController.normalize() validates all path vari..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T13:12:30.880945+00:00",
      "status_notes": "Vulnerability CVE-2020-5410 does not affect version 3.1.10-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. CVE-2020-5410 (directory traversal via crafted URLs) is NOT present in Spring Cloud Config 3.1.10. Both required security fixes were already included in the upstream 3.1.10 release before TuxCare onboarding. The target contains: (1) input validation in EnvironmentController.normalize() that rejects paths with \"..\", \"#\", and encoded variants via PathUtils.isInvalidEncodedLocation(), and (2) resource location verification in GenericResourceRepository via PathUtils.checkResource() ensuring files remain within allowed directories. These defenses block the attack chain from malicious Input (URL parameters with traversal sequences) to Goal (file access outside config directories).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3), NVD (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3), cve.org (>= 2.1, < 2.1.9; >= 2.2, < 2.2.3), Snyk (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5410"
      },
      "impact_statement": "CVE-2020-5410 (directory traversal via crafted URLs) is NOT present in Spring Cloud Config 3.1.10. Both required security fixes were already included in the upstream 3.1.10 release before TuxCare onboarding. The target contains: (1) input validation in EnvironmentController.normalize() that rejects paths with \"..\", \"#\", and encoded variants via PathUtils.isInvalidEncodedLocation(), and (2) resource location verification in GenericResourceRepository via PathUtils.checkResource() ensuring files remain within allowed directories. These defenses block the attack chain from malicious Input (URL parameters with traversal sequences) to Goal (file access outside config directories).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3), NVD (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3), cve.org (>= 2.1, < 2.1.9; >= 2.2, < 2.2.3), Snyk (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T13:12:30.880945+00:00",
      "status_notes": "Vulnerability CVE-2025-22232 does not affect version 3.1.10-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. not_affected \u2014 Target is not affected by CVE-2025-22232. The vulnerability (Spring Cloud Config Server using persisted Vault tokens instead of per-request X-CONFIG-TOKEN header values) was fixed in upstream commit 2c4f7842 authored by Ryan Baxter, which shipped in the upstream 3.1.10 release before TuxCare onboarded this version. The fix introduces StatelessSessionManager that retrieves fresh tokens on every ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22232"
      },
      "impact_statement": "not_affected \u2014 Target is not affected by CVE-2025-22232. The vulnerability (Spring Cloud Config Server using persisted Vault tokens instead of per-request X-CONFIG-TOKEN header values) was fixed in upstream commit 2c4f7842 authored by Ryan Baxter, which shipped in the upstream 3.1.10 release before TuxCare onboarded this version. The fix introduces StatelessSessionManager that retrieves fresh tokens on every ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T13:12:30.880945+00:00",
      "status_notes": "Vulnerability CVE-2026-22739 affects version 3.1.10-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-22739"
      },
      "action_statement": "Vulnerability CVE-2026-22739 affects version 3.1.10-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T13:17:00.220923+00:00",
      "status_notes": "Vulnerability CVE-2026-40981 is fixed in version 3.1.10-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-40981"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T13:17:00.220923+00:00",
      "status_notes": "Vulnerability CVE-2026-40982 is fixed in version 3.1.10-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-40982"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T13:17:00.220923+00:00",
      "status_notes": "Vulnerability CVE-2026-41002 is fixed in version 3.1.10-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-41002"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T13:17:00.220923+00:00",
      "status_notes": "Vulnerability CVE-2026-41004 is fixed in version 3.1.10-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-41004"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T13:17:00.220923+00:00",
      "status_notes": "Vulnerability CVE-2026-47836 is fixed in version 3.1.10-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-47836"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T13:17:00.220923+00:00",
      "status_notes": "Vulnerability CVE-2026-47837 is fixed in version 3.1.10-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-47837"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T13:17:00.220923+00:00",
      "status_notes": "Vulnerability CVE-2026-47894 is fixed in version 3.1.10-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-47894"
      }
    }
  ]
}