Last active
September 4, 2023 03:04
CVE-2023-40788
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
CVE-2023-40788 | |
[description] | |
SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error logs | |
[Vulnerability Type] | |
Incorrect Access Control | |
[Vendor of Product] | |
https://github.com/chillzhuang/SpringBlade | |
[Affected Product Code Base] | |
SpringBlade - V3.6.0 | |
[Attack Type] | |
Remote | |
[Attack Vectors] | |
In the default configuration https://github.com/chillzhuang/SpringBlade/blob/master/blade-gateway/src/main/java/org/springblade/gateway/provider/AuthProvider.java /error/** and /log/* * will not authenticate and thus lead to unauthorized | |
[Discoverer] | |
cyvk |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment