| शीर्षक | alldatacenter alldata v0.6.8 CWE-22 |
|---|
| विवरण | The service-data-dts endpoint GET /log/logDetailCat opens a FileInputStream directly on the caller-supplied executorAddress parameter and returns the file contents in the HTTP response, with no path validation or confinement. Because the service marks every request permitAll() in its Spring Security configuration, the endpoint is reachable with no credentials. An unauthenticated attacker can read any file accessible to the service account, including application configuration and credentials. |
|---|
| स्रोत | ⚠️ https://github.com/alldatacenter/alldata/issues/834 |
|---|
| उपयोगकर्ता | fakebug (UID 94486) |
|---|
| सबमिशन | 26/06/2026 04:20 AM (2 महीनों पहले) |
|---|
| संयम | 14/08/2026 07:50 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 389960 [alldatacenter alldata तक 0.6.8 logDetailCat Endpoint JobLogController.java FileInputStream executorAddress निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|