Lamp Cloud
Monthly
Authenticated users of lamp-cloud (dromara/lamp-cloud) through version 5.10.0 can permanently delete notifications belonging to other users by calling DELETE /anyone/extendNotice/deleteMyNotice with arbitrary notice IDs, because the endpoint deletes by the attacker-supplied key without verifying that the notice belongs to the requester. Any low-privilege account with network access to the application is sufficient - no administrative role and no user interaction are required (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) - and because notice IDs appear to be sequential/enumerable, a single authenticated user can systematically purge the notification records of other tenants/users. Publicly available exploit code exists (a PoC script targeting the notice-delete BOLA was published in the LinYuanyi1/cve-request-poc repository and reported by VulnCheck), though the impact is bounded to integrity and availability of the notice subsystem with no data disclosure.
Authenticated profile tampering in dromara lamp-cloud through 5.10.0 lets any logged-in user overwrite other users' profile records - nickname, ID card, sex, nation, education, work description and avatar attachment - by supplying a victim's user ID in the body of a PUT request to /anyone/baseInfo or /anyone/avatar. The root cause is a broken object-level authorization (BOLA/IDOR, CWE-639) in the lamp-oauth UserInfoController, which takes the target identity from attacker-controlled request data instead of the authenticated session; exploitation requires only a low-privilege account (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N, no user interaction) and is scored 7.1 with impact confined to integrity. Publicly available exploit code exists (two Python BOLA proof-of-concept scripts published alongside the VulnCheck advisory), while no confirmed active exploitation (CISA KEV) is reported for this issue at time of analysis.
Authenticated users of Dromara lamp-cloud through 5.10.0 can download other users' stored attachments by supplying a valid attachment identifier to the /anyone/file/down or /anyone/file/download endpoints in FileAnyoneController, which never validate the file's created_by owner column against the requesting principal (CWE-639, IDOR/BOLA). The flaw is network-reachable and low-complexity, requires only a low-privilege authenticated account and no user interaction, and yields high confidentiality impact with no integrity or availability effect; it is rated 7.1 under CVSS 4.0 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Publicly available exploit code exists (a Python proof-of-concept published on GitHub), but the issue is not listed in CISA KEV, so no confirmed active exploitation is established at time of analysis.
Authenticated users on any Dromara lamp-cloud deployment up to and including 5.10.0 can read the complete profile of every other user by calling the getUserInfoById endpoint with an arbitrary userId, exposing mobile numbers, email addresses, national identity card numbers, and WeChat/DingTalk OpenIDs. The flaw is a classic object-level authorization bypass (CWE-639) requiring only a valid low-privileged account - no elevated role, user interaction, or non-default configuration - and publicly available exploit code exists (a Python BOLA PoC in the LinYuanyi1/cve-request-poc repository), so userIds can be enumerated at scale to harvest PII. There is no confirmed CISA KEV entry and no evidence of active exploitation; the risk is best characterized as a moderate, not urgent, priority driven by the high confidentiality impact and the low-effort, automatable nature of the enumeration, tempered by the relatively small footprint of this open-source Spring Cloud framework. Vendor-released patch: none identified at time of analysis.
Unauthenticated information disclosure in Dromara lamp-cloud through 5.10.0 stems from an overly broad anonymous-access whitelist pattern (/*/anno/**) that exposes the /defGenProject/anno/getProperties endpoint. Any remote attacker who can reach the service via HTTP can POST to that path and receive the server's complete JVM system property map, leaking classpath entries, filesystem paths, OS build details, and startup secrets injected as properties. Exploit code is publicly available (a writeup and proof-of-concept are linked from the CVE references and VulnCheck advisory), and the flaw has not been listed in CISA KEV, so it is a high-value reconnaissance and credential-harvesting primitive rather than a confirmed mass-exploitation event.
Remote code execution in LAMP Rapid Development Platform (dromara lamp-cloud) through version 5.6.2 allows low-privileged authenticated attackers to inject arbitrary Groovy code into message template script fields processed by the GlueFactory component, resulting in OS command execution on the backend server with the privileges of the Java process. The GlueFactory compiled and ran these scripts via GroovyClassLoader with no sandboxing, AST restrictions, or class whitelisting in place. A publicly available exploit exists via GitHub issue #408, and CVSS 4.0 rates this 8.7 with full confidentiality, integrity, and availability impact on the vulnerable system.
Authenticated users of lamp-cloud through 5.10.0 can read any other employee's role codes, permission codes, and full front-end router tree by supplying arbitrary employeeId values to the /anyone/visible/resource endpoint, which never verifies that the requested identifier belongs to the caller. Exploitation is trivial - any low-privilege account suffices, the identifiers appear to be enumerable integers, no user interaction or elevated privilege is required, and publicly available exploit code exists (a Python PoC targeting this exact BOLA condition). The flaw is confirmed as an object-level authorization failure (CWE-639) and is not known to be actively exploited (no CISA KEV listing); impact is limited to read-only disclosure of authorization metadata, which matches the assessed CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Server-side template injection (SSTI) in Dromara lamp-cloud versions 5.6.0 through 5.6.2 exposes the Message Template Handler to remote exploitation by authenticated low-privileged users who can inject malicious Groovy expressions via the DefMsgTemplate.content parameter. The vulnerable function GroovyClassLoader.parseClass compiles and executes attacker-controlled input as Groovy code at runtime. A public proof-of-concept exploit has been disclosed on GitHub, and the vendor has not responded to the coordinated disclosure, leaving no official patch available at time of analysis.
Improper authorization in Dromara lamp-cloud up to version 5.8.1 allows authenticated remote attackers to bypass access controls in the DefUserController pageUser endpoint, gaining unauthorized read access to sensitive user information. The CVSS score of 4.3 reflects low confidentiality impact with network accessibility and low attack complexity; however, public exploit code availability and vendor non-responsiveness increase real-world risk despite the modest base score.
Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.
Authenticated users of lamp-cloud (dromara/lamp-cloud) through version 5.10.0 can permanently delete notifications belonging to other users by calling DELETE /anyone/extendNotice/deleteMyNotice with arbitrary notice IDs, because the endpoint deletes by the attacker-supplied key without verifying that the notice belongs to the requester. Any low-privilege account with network access to the application is sufficient - no administrative role and no user interaction are required (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) - and because notice IDs appear to be sequential/enumerable, a single authenticated user can systematically purge the notification records of other tenants/users. Publicly available exploit code exists (a PoC script targeting the notice-delete BOLA was published in the LinYuanyi1/cve-request-poc repository and reported by VulnCheck), though the impact is bounded to integrity and availability of the notice subsystem with no data disclosure.
Authenticated profile tampering in dromara lamp-cloud through 5.10.0 lets any logged-in user overwrite other users' profile records - nickname, ID card, sex, nation, education, work description and avatar attachment - by supplying a victim's user ID in the body of a PUT request to /anyone/baseInfo or /anyone/avatar. The root cause is a broken object-level authorization (BOLA/IDOR, CWE-639) in the lamp-oauth UserInfoController, which takes the target identity from attacker-controlled request data instead of the authenticated session; exploitation requires only a low-privilege account (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N, no user interaction) and is scored 7.1 with impact confined to integrity. Publicly available exploit code exists (two Python BOLA proof-of-concept scripts published alongside the VulnCheck advisory), while no confirmed active exploitation (CISA KEV) is reported for this issue at time of analysis.
Authenticated users of Dromara lamp-cloud through 5.10.0 can download other users' stored attachments by supplying a valid attachment identifier to the /anyone/file/down or /anyone/file/download endpoints in FileAnyoneController, which never validate the file's created_by owner column against the requesting principal (CWE-639, IDOR/BOLA). The flaw is network-reachable and low-complexity, requires only a low-privilege authenticated account and no user interaction, and yields high confidentiality impact with no integrity or availability effect; it is rated 7.1 under CVSS 4.0 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Publicly available exploit code exists (a Python proof-of-concept published on GitHub), but the issue is not listed in CISA KEV, so no confirmed active exploitation is established at time of analysis.
Authenticated users on any Dromara lamp-cloud deployment up to and including 5.10.0 can read the complete profile of every other user by calling the getUserInfoById endpoint with an arbitrary userId, exposing mobile numbers, email addresses, national identity card numbers, and WeChat/DingTalk OpenIDs. The flaw is a classic object-level authorization bypass (CWE-639) requiring only a valid low-privileged account - no elevated role, user interaction, or non-default configuration - and publicly available exploit code exists (a Python BOLA PoC in the LinYuanyi1/cve-request-poc repository), so userIds can be enumerated at scale to harvest PII. There is no confirmed CISA KEV entry and no evidence of active exploitation; the risk is best characterized as a moderate, not urgent, priority driven by the high confidentiality impact and the low-effort, automatable nature of the enumeration, tempered by the relatively small footprint of this open-source Spring Cloud framework. Vendor-released patch: none identified at time of analysis.
Unauthenticated information disclosure in Dromara lamp-cloud through 5.10.0 stems from an overly broad anonymous-access whitelist pattern (/*/anno/**) that exposes the /defGenProject/anno/getProperties endpoint. Any remote attacker who can reach the service via HTTP can POST to that path and receive the server's complete JVM system property map, leaking classpath entries, filesystem paths, OS build details, and startup secrets injected as properties. Exploit code is publicly available (a writeup and proof-of-concept are linked from the CVE references and VulnCheck advisory), and the flaw has not been listed in CISA KEV, so it is a high-value reconnaissance and credential-harvesting primitive rather than a confirmed mass-exploitation event.
Remote code execution in LAMP Rapid Development Platform (dromara lamp-cloud) through version 5.6.2 allows low-privileged authenticated attackers to inject arbitrary Groovy code into message template script fields processed by the GlueFactory component, resulting in OS command execution on the backend server with the privileges of the Java process. The GlueFactory compiled and ran these scripts via GroovyClassLoader with no sandboxing, AST restrictions, or class whitelisting in place. A publicly available exploit exists via GitHub issue #408, and CVSS 4.0 rates this 8.7 with full confidentiality, integrity, and availability impact on the vulnerable system.
Authenticated users of lamp-cloud through 5.10.0 can read any other employee's role codes, permission codes, and full front-end router tree by supplying arbitrary employeeId values to the /anyone/visible/resource endpoint, which never verifies that the requested identifier belongs to the caller. Exploitation is trivial - any low-privilege account suffices, the identifiers appear to be enumerable integers, no user interaction or elevated privilege is required, and publicly available exploit code exists (a Python PoC targeting this exact BOLA condition). The flaw is confirmed as an object-level authorization failure (CWE-639) and is not known to be actively exploited (no CISA KEV listing); impact is limited to read-only disclosure of authorization metadata, which matches the assessed CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Server-side template injection (SSTI) in Dromara lamp-cloud versions 5.6.0 through 5.6.2 exposes the Message Template Handler to remote exploitation by authenticated low-privileged users who can inject malicious Groovy expressions via the DefMsgTemplate.content parameter. The vulnerable function GroovyClassLoader.parseClass compiles and executes attacker-controlled input as Groovy code at runtime. A public proof-of-concept exploit has been disclosed on GitHub, and the vendor has not responded to the coordinated disclosure, leaving no official patch available at time of analysis.
Improper authorization in Dromara lamp-cloud up to version 5.8.1 allows authenticated remote attackers to bypass access controls in the DefUserController pageUser endpoint, gaining unauthorized read access to sensitive user information. The CVSS score of 4.3 reflects low confidentiality impact with network accessibility and low attack complexity; however, public exploit code availability and vendor non-responsiveness increase real-world risk despite the modest base score.
Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.