PT-2023-22505 · Unknown · Spring-Boot-Actuator-Logview

CVE-2023-29986 · Publicado 2023-05-11 · Atualizado 2025-01-27

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions spring-boot-actuator-logview version 0.2.13

Description The issue allows Directory Traversal to sibling directories via the LogViewEndpoint.view endpoint. This enables access to files outside the intended directory, potentially leading to sensitive information disclosure.

Recommendations For spring-boot-actuator-logview version 0.2.13, consider disabling the LogViewEndpoint.view endpoint until a patch is available to prevent Directory Traversal attacks. Restrict access to sensitive files and directories to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-29986

Produtos afetados

Spring-Boot-Actuator-Logview

Referências · 7

• https://github.com/lukashinsch/spring-boot-actuator-logview/issues/33 · Nota
• https://osv.dev/vulnerability/CVE-2023-29986 · Aviso do Fabricante
• https://t.me/cvenotify/108692 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-29986 · Nota de Segurança
• https://t.me/cibsecurity/63855 · Publicação no Telegram
• https://t.me/cvenotify/50934 · Publicação no Telegram
• https://t.me/cvenotify/50210 · Publicação no Telegram