요약
- CVE-2026-41004은(는) org.springframework.cloud:spring-cloud-config-server, spring cloud config (vmware)에 영향을 주는 보통 (CVSS 4.4) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.17%, 전체 취약점의 6.0%보다 높음.
- 조치: 4.3.3, 5.0.3, 3.1.14, 4.1.10 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| org.springframework.cloud:spring-cloud-config-server Maven | ≥ 3.0.0, ≤ 3.0.7≥ 3.1.0, ≤ 3.1.13≥ 4.1.0, ≤ 4.1.9≥ 4.2.0, ≤ 4.2.6≥ 4.3.0, < 4.3.3≥ 5.0.0, < 5.0.3
| 4.3.35.0.3
|
| spring cloud config | ≥ 3.1.0, < 3.1.14≥ 4.1.0, < 4.1.10≥ 4.2.0, < 4.2.7≥ 4.3.0, < 4.3.3≥ 5.0.0, < 5.0.3
| 3.1.144.1.104.2.74.3.35.0.3
|
Description
When trace logging is enabled in Spring Cloud Config Server, sensitive information is placed in plain text in the logs.
- Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 (inclusive); no open-source upgrade available.
- Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater.
- Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
NVD description
When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
org.springframework.cloud:spring-cloud-config-server의 다른 취약점
모두 보기 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free