CVE-2026-91996lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint

Açıklama

lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• Researcher write-up third-party-advisoryexploit
• IgnoreProperties.java anonymous-path whitelist technical-description
• DefGenProjectController.getProperties technical-description
• https://github.com/dromara/lamp-cloud product
• VulnCheck Advisory: lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint third-party-advisory