Spring Boot Actuator Logview is a library that adds a simple logfile viewer as Spring Boot Actuator endpoint. In Spring Boot Actuator Logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (Spring Boot Actuator) HTTP endpoints. Both the filename to view and a base folder can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits, the base folder parameter was not sufficiently checked.

Spring Boot Actuator Logview 是一個程式庫，可將簡單的記錄檔檢視器新增為 Spring Boot Actuator 端點。Spring Boot Actuator Logview 0.2.13 之前版本中包含目錄遊走弱點。此程式庫的本質是透過 admin (Spring Boot Actuator) HTTP 端點暴露記錄檔目錄。可透過要求參數指定要檢視的檔案名稱和基本資料夾。雖然檢查了 filename 參數以防止目錄遊走攻擊，但未對基本資料夾參數進行充分檢查。

Spring Boot Actuator Logview 是一个添加简单日志文件查看器作为 Spring Boot Actuator 端点的库。在版本 0.2.13 之前的 Spring Boot Actuator Logview 中，存在一个目录遍历漏洞。此库的本质是通过 admin (Spring Boot Actuator) HTTP 端点暴露日志文件目录。通过请求参数可以指定要查看的文件名和基本文件夹。尽管已检查文件名参数以防止目录遍历利用，但并未充分检查基本文件夹参数。

Spring Boot Actuator Logview は、シンプルなログファイルビューアーを Spring Boot Actuator エンドポイントとして追加するライブラリです。バージョン 0.2.13 より前の Spring BootActuator Logview には、ディレクトリトラバーサルの脆弱性があります。このライブラリの性質は、admin (Spring Boot Actionuator) HTTP エンドポイントを介してログファイルディレクトリを公開することです。表示するファイル名とベースフォルダの両方をリクエストパラメーターで指定できます。ディレクトリトラバーサルの悪用を防ぐためにファイル名パラメーターがチェックされていましたが、ベースフォルダパラメーターが十分にチェックされていませんでした。

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator
    endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview
    before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to
    expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and
    a base folder (relative to the logging folder root) can be specified via request parameters. While the
    filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile`
    would not work), the base folder parameter was not sufficiently checked, so that
    `filename=somefile&base=../` could access a file outside the logging base directory). The vulnerability
    has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as
    there are no other changes in that release. There is no workaround to fix the vulnerability other than
    updating or removing the dependency. However, removing read access of the user the application is run with
    to any directory not required for running the application can limit the impact. Additionally, access to
    the logview endpoint can be limited by deploying the application behind a reverse proxy. (CVE-2021-21234)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
113197	Spring Boot Actuator Logview < 0.2.13 Directory Traversal	Web App Scanning	Component Vulnerability	2022/3/24	2023/3/13	high
113197	Spring Boot Actuator Logview < 0.2.13 目錄遊走	Web App Scanning	Component Vulnerability	2022/3/24	2023/3/13	high
113197	Spring Boot Actuator Logview < 0.2.13 目录遍历	Web App Scanning	Component Vulnerability	2022/3/24	2023/3/13	high
113197	Spring Boot Actuator Logview < 0.2.13 のディレクトリトラバーサル	Web App Scanning	Component Vulnerability	2022/3/24	2023/3/13	high
417279	SCA: security update for eu.hinsch:spring-boot-actuator-logview (GHSA-p4q6-qxjx-8jgp)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	high
417279	SCA: security update for eu.hinsch:spring-boot-actuator-logview (GHSA-p4q6-qxjx-8jgp)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	high

检测

插件搜索

high

high

high

high

high

high