Versa Concerto Actuator Endpoint - Authentication Bypass

An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting...

SpringBoot_Actuator_RCE

swagger-ui Interface /swagger-ui.html SpringBoot env: Obtaining Sensitive Information Masked with Part 1 When we directly visit the springboot site, we can see that some password fields are filled with 1. Plaintext fields can be obtained via $name 2. Misconfiguration leads to sensitive informatio...

CVE-2022-22947

CVE-2022-22947 CVE-2022-22947 Spring-Cloud-Gateway En el primer trimestre de 2022, se descubrió una vulnerabilidad interesante y crítica puntuación base de 10.0 de inyección de código en Spring Cloud Gateway que aprovecha la API Actuator para realizar una inyección SpEL, lo que puede llevar a...

CVE-2025-41243-Vulnerability-Lab

CVE-2025-41243: Spring Cloud Gateway RCE Lab Descripción de la vulnerabilidad Spring Cloud Gateway presenta una vulnerabilidad de inyección de expresiones SpEL. Cuando el endpoint Actuator está habilitado, un atacante puede lograr la ejecución remota de código RCE. Método de inicio docker-compose...

CVE-2022-22947

Spring Cloud Gateway Actuator API Exp de inyección de expresión SpEL y ejecución de comandos Uso：python3 CVE-2022-22947.py -u "http://127.0.0.1:8080" -c "whoami" Resultado： ¡Ruta de expresión SpEL maliciosa añadida con éxito! ¡Ruta actualizada con éxito! Resultado de ataque obtenido con éxito:...

CVE-2021-21234

CVE-2021-21234 CVE-2021-21234 Recorrido de directorios en Spring Boot spring-boot-actuator-logview añade un simple visor de archivos de registro como endpoint del actuator de Spring Boot en una biblioteca. Es el paquete Maven «eu.hinsch:spring-boot-actuator-logview». Existe una vulnerabilidad de...

spring-cloud-gateway-cve-2022-22947-report

spring-cloud-gateway-cve-2022-22947-report Technical report about CVE-2022-22947 in Spring Cloud Gateway and its exploitation through exposed Actuator endpoints...

Spring-Cloud-Gateway-CVE-2022-22947

Spring-Cloud-Gateway-CVE-2022-22947 Aviso de seguridad sobre la vulnerabilidad de ejecución remota de código en Spring Cloud Gateway. Esta vulnerabilidad permite que las aplicaciones que utilizan Spring Cloud Gateway puedan sufrir ataques de inyección de código cuando el endpoint Gateway Actuator...

CVE-2022-22947

CVE-2022-22947 A code injection attack on spring cloud gateway Summary of the CVE In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+, applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make ...

CVE-2022-22947-

CVE-2022-22947 Inyección de expresión SpEL en la API Actuator de Spring Cloud Gateway para ejecución de comandos CVE-2022-22947 Inyección de memoria Godzilla Clave predeterminada pass base64 Nota: El código no limpia la parte de la ruta, límpiela usted mismo.. Entorno de prueba:...

CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE

CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE Introducción a CVE-2022-22947 危害等级：高危 POC/EXP情况：已公开 CNVD编号：CNNVD-2022-16402 影响范围： Spring Cloud GateWay 3.1.0 Spring Cloud GateWay =3.0.0，=3.0.6 Spring Cloud GateWay 3.0.0 Descripción de la vulnerabilidad Spring Cloud Gateway tiene una vulnerabilidad de...

CVE-2026-78214

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...

EUVD-2026-88815

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...

CVE-2026-78214 Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...

CVE-2026-78214

An authentication bypass vulnerability exists in Apache DolphinScheduler versions prior to 3.4.3 . The root cause is an improper security check where the application fails to correctly identify protected Actuator endpoints when receiving requests with percent-encoded paths . A remote unauthentica...

CVE-2026-78214 Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...

PT-2026-102615

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...

CVE-2026-78214: Incorrect Authorization

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...

K000163434: Spring Boot vulnerability CVE-2026-40976

Security Advisory Description In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on t...

Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...