-
Notifications
You must be signed in to change notification settings - Fork 1.7k
Open
Description
Summary
In the latest version 6.0.0, all microservices' Spring Actuator interfaces have no access control whatsoever, allowing any user to access and obtain various configurations, environment variables, and other sensitive information of the corresponding services.
POC
http://localhost:{port}/actuator
such as:
http://localhost:9900/actuator
http://localhost:7200/actuator



Metadata
Metadata
Assignees
Labels
No labels