CVEvulnerability

CVE-2026-59284

7.6 HIGH Published 2026-08-27 Modified 2026-09-01 Official page ↗
Status
Analyzed
Published
2026-08-27
Last modified
2026-09-01
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L
Weaknesses
CWE-915

Description

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier

Affected configurations

• broadcom spring cloud commons (< 3.1.11) • broadcom spring cloud commons (>= 4.0.0 < 4.2.7) • broadcom spring cloud commons (>= 4.3.0 < 4.3.4) • broadcom spring cloud commons (>= 5.0.0 < 5.0.3)

Related

Weakness · CWE (1)

  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References