This vulnerability is a TOCTOU race condition (CWE-367) in the Spring Cloud Config Server's handling of the base directory (`spring.cloud.config.server.git.basedir`) where Git repositories are cloned. The affected versions span multiple release lines from 3.1.x to 5.0.x. The race condition arises because the server checks the directory state and then uses it, allowing an attacker with sufficient privileges to manipulate the directory state between these operations. The CVSS 3.1 score is 7.4 (high), reflecting local attack vector, high complexity, required privileges, no user interaction, and high impact on confidentiality and integrity. Fixed versions have been released: 3.1.14+, 4.1.10+, 4.2.7+, 4.3.3+, and 5.0.3+, though some fixes require Enterprise Support. No known exploits have been reported.

Successful exploitation could allow an attacker with high privileges on the host to manipulate the base directory used for Git cloning, potentially leading to unauthorized disclosure or modification of configuration data managed by Spring Cloud Config Server. The vulnerability does not impact availability. The high CVSS score indicates significant confidentiality and integrity impact but requires local access and elevated privileges.

Upgrading to the fixed versions is the recommended remediation: 3.1.14 or later (Enterprise Support Only), 4.1.10 or later (Enterprise Support Only), 4.2.7 or later (Enterprise Support Only), 4.3.3 or later, and 5.0.3 or later. Since some fixes are limited to Enterprise Support customers, organizations should consult their vendor support agreements. Patch status is not explicitly confirmed in the advisory, but version upgrades are indicated as fixes. No other mitigations or workarounds are provided. Monitor vendor advisories for updates.