Cloud Vulnerability DB
A community-led vulnerabilities database
Wiz Agents & Workflows are here
Vulnerability DatabaseCVE-2021-37304
CVE-2021-37304:
Java vulnerability analysis and mitigation
Overview
An Insecure Permissions vulnerability was discovered in jeecg-boot version 2.4.5 and earlier versions. The vulnerability allows unauthenticated remote attackers to gain unauthorized access to the httptrace interface, potentially exposing sensitive information such as user cookies, client IP addresses, browser user agents, and tokens (MITRE CVE, GitHub Issue).
Technical details
The vulnerability exists in the httptrace interface accessible at /jeecg-boot/actuator/httptrace/. The interface lacks proper authentication controls, allowing any unauthenticated user to access sensitive trace information. This vulnerability was identified and reported through the project's GitHub repository (GitHub Issue).
Impact
The exploitation of this vulnerability can lead to the exposure of sensitive information including user cookies, authentication tokens, client IP addresses, and browser user agent strings. This information could potentially be used by attackers to conduct further attacks or gain unauthorized access to user accounts (GitHub Issue).
Additional resources
Source: This report was generated using AI
Related Java vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management