EUVD-2026-34988
GHSA-f5ww-rmh9-9wmc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This issue affects some unknown processing of the file /base-boot/actuator of the component Boot Actuator Endpoint. Executing a manipulation can lead to information disclosure. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unauthenticated remote access to the Spring Boot Actuator endpoint in erzhongxmu JeeWMS exposes sensitive application internals to any network-reachable attacker. The /base-boot/actuator path, part of the Spring Boot management framework, is accessible without credentials, potentially leaking environment variables, configuration properties, internal service topology, and application health data. A publicly available proof-of-concept exploit exists per CVSS temporal modifier E:P and a referenced GitHub issue; however, this vulnerability has not been confirmed in CISA KEV as actively exploited at time of analysis.
Technical ContextAI
JeeWMS is a Java-based warehouse management system (CPE: cpe:2.3:a:erzhongxmu:jeewms:*) built on the Spring Boot framework. Spring Boot Actuator is a management sub-framework that exposes operational endpoints - including /env (environment variables), /beans (application context), /configprops (configuration properties), /mappings (URL routes), and /health - for monitoring and diagnostics. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the actuator base path at /base-boot/actuator is not protected by Spring Security or equivalent access controls, meaning its sub-endpoints are reachable by unauthenticated HTTP clients. Depending on which sub-endpoints are enabled and what data the application loads into the Spring context, the disclosed data can range from benign health status to plaintext database credentials or internal API keys.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure. As an immediate compensating control, restrict access to the /base-boot/actuator path and all sub-paths at the network perimeter (WAF, reverse proxy, or firewall ACL) to trusted administrative IP ranges only; this eliminates the attack surface without application changes. If application-level control is possible, configure Spring Security to require authentication for all actuator endpoints by adding a security rule matching /actuator/** with an authenticated() requirement, or set management.endpoints.web.exposure.include in application.properties to an explicit allowlist of non-sensitive endpoints (e.g., health, info only), disabling /env, /beans, /configprops, and /mappings. Trade-off: restricting actuator access may break existing monitoring or alerting integrations that poll these endpoints. Rotating any credentials or API keys that may have been exposed via /env is advisable if the endpoint was previously internet-accessible. Track remediation via https://vuldb.com/vuln/369077.
An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component. R
Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information vi
A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms 3.7. Rated medium severity (CVSS 6.9), this v
A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute a
Jeewms 3.7 contains a server-side request forgery vulnerability in the UEditor plugin's getRemoteImage.jsp file, where t
Code injection in erzhongxmu JeeWMS via the JimuReport test-connection endpoint (/base-boot/jmreport/testConnection) all
A vulnerability was found in erzhongxmu Jeewms up to 20241108. Rated medium severity (CVSS 5.3), this vulnerability is r
A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical.html o
JEEWMS 1.0 is vulnerable to SQL Injection. Attackers can inject malicious SQL statements through the id1 and id2 paramet
Reflected cross-site scripting in Jeewms up to version 3.7 exists in the UEditor component's getContent.jsp file through
Cross-site scripting (XSS) in the doAdd function of Jeewms up to version 3.7 allows unauthenticated remote attackers to
A Cross Site Scripting vulnerability in JeeWMS v.3.7 and before allows a remote attacker to obtain sensitive information
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today