漏洞描述
spring-boot-actuator-logview before version 0.2.13 contains a directory traversal vulnerability in libraries that adds a simple logfile viewer as a spring boot actuator endpoint (maven package "eu.hinsch:spring-boot-actuator-logview".
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
blogg.pwc.nohttps://blogg.pwc.no/styringogkontroll/unauthenticated-directory-traversal-vulnerability-in-a-java-spring-boot-actuator-library-cve-2021-21234↗github.comhttps://github.com/cristianeph/vulnerability-actuator-log-viewer↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-21234↗github.comhttps://github.com/lukashinsch/spring-boot-actuator-logview/commit/760acbb939a8d1f7d1a7dfcd51ca848eea04e772↗github.comhttps://github.com/lukashinsch/spring-boot-actuator-logview/commit/1c76e1ec3588c9f39e1a94bf27b5ff56eb8b17d6↗blog.csdn.nethttps://blog.csdn.net/qq_39583774/article/details/123023770#t5↗