CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthenticated attackers to exploit the lamp-cloud application versions up to 5.10.0 by accessing sensitive server information through the endpoint /defGenProject/anno/getProperties. This exposure can lead to the disclosure of critical data such as JVM classpath, filesystem paths, and operating system details, potentially compromising the entire system. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized information disclosure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.