| 제목 | Halo 2.21.10 Exposure of Sensitive Information Due to Incompatible Policies |
|---|
| 설명 | In the Halo release version (currently the latest is 2.21.10), due to improper Spring actuator endpoint configurations that are also unnecessary for business operations, multiple sensitive endpoints (such as env, heapdump, logfile, etc.) are exposed, potentially resulting in the leakage of sensitive information. |
|---|
| 원천 | ⚠️ https://github.com/SECWG/cve/issues/9 |
|---|
| 사용자 | WenGui (UID 82184) |
|---|
| 제출 | 2025. 12. 14. PM 02:38 (10 개월 ago) |
|---|
| 모더레이션 | 2025. 12. 27. AM 11:18 (13 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 338519 [Halo 까지 2.21.10 Configuration /actuator 정보 공개] |
|---|
| 포인트들 | 18 |
|---|