| 标题 | Halo 2.21.10 Exposure of Sensitive Information Due to Incompatible Policies |
|---|
| 描述 | In the Halo release version (currently the latest is 2.21.10), due to improper Spring actuator endpoint configurations that are also unnecessary for business operations, multiple sensitive endpoints (such as env, heapdump, logfile, etc.) are exposed, potentially resulting in the leakage of sensitive information. |
|---|
| 来源 | ⚠️ https://github.com/SECWG/cve/issues/9 |
|---|
| 用户 | WenGui (UID 82184) |
|---|
| 提交 | 2025-12-14 14時38分 (10 月前) |
|---|
| 管理 | 2025-12-27 11時18分 (13 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 338519 [Halo 直到 2.21.10 Configuration /actuator 信息公开] |
|---|
| 积分 | 18 |
|---|