CVE-2026-91996lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint

Beschreibung

lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• Researcher write-up third-party-advisoryexploit
• IgnoreProperties.java anonymous-path whitelist technical-description
• DefGenProjectController.getProperties technical-description
• https://github.com/dromara/lamp-cloud product
• VulnCheck Advisory: lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint third-party-advisory