Tóm tắt nhanh
- CVE-2026-41004 là lỗ hổng mức TRUNG BÌNH (CVSS 4.4) ảnh hưởng org.springframework.cloud:spring-cloud-config-server, spring cloud config (vmware).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.17%, cao hơn 6.0% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 4.3.3, 5.0.3, 3.1.14, 4.1.10 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| org.springframework.cloud:spring-cloud-config-server Maven | ≥ 3.0.0, ≤ 3.0.7≥ 3.1.0, ≤ 3.1.13≥ 4.1.0, ≤ 4.1.9≥ 4.2.0, ≤ 4.2.6≥ 4.3.0, < 4.3.3≥ 5.0.0, < 5.0.3
| 4.3.35.0.3
|
| spring cloud config | ≥ 3.1.0, < 3.1.14≥ 4.1.0, < 4.1.10≥ 4.2.0, < 4.2.7≥ 4.3.0, < 4.3.3≥ 5.0.0, < 5.0.3
| 3.1.144.1.104.2.74.3.35.0.3
|
Mô tả
When trace logging is enabled in Spring Cloud Config Server, sensitive information is placed in plain text in the logs.
- Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 (inclusive); no open-source upgrade available.
- Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater.
- Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Mô tả của NVD
When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Lỗ hổng khác của org.springframework.cloud:spring-cloud-config-server
Xem tất cả →Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí