CyberRota Analysis
AI-GeneratedZipkin versions up to 3.6.1 are vulnerable due to the exposure of Spring Boot Actuator endpoints on the tracing API port without authentication, enabling unauthenticated attackers to access sensitive information such as environment variables and storage credentials. The potential impact includes unauthorized data disclosure and the ability to manipulate logging behavior, which could hinder incident detection. Organizations using affected versions of Zipkin should prioritize remediation to protect sensitive data and maintain operational integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify log levels to suppress logging.