PT-2025-32409 · Unknown · Zlt2000 Microservices-Platform+1

Zast.Ai · Published 2025-08-08 · Updated 2025-08-08 · CVE-2025-8738

Positive Technologies (AI Summary)

CVSS v4.0

5.5

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions zlt2000 microservices-platform versions through 6.0.0

Description A vulnerability exists in zlt2000 microservices-platform. The issue affects unknown code within the /actuator file of the Spring Actuator Interface component, leading to information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

CVE-2025-8738

Affected Products

Spring Actuator Interface

Zlt2000 Microservices-Platform

References · 9

• 🔥 https://github.com/zlt2000/microservices-platform/issues/79#issue-3264850271 · Exploit
• https://osv.dev/vulnerability/CVE-2025-8738 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8738 · Security Note
• https://github.com/zlt2000/microservices-platform/issues/79 · Note
• https://vuldb.com/?ctiid.319234 · Note
• https://twitter.com/CVEnew/status/1953920327039250705 · Twitter Post
• https://vuldb.com/?submit.623478 · Note
• https://t.me/CVEtracker/29549 · Telegram Post
• https://vuldb.com/?id.319234 · Note