Spring Cloud Platform
Monthly
Missing authorization in wxiaoqi Spring-Cloud-Platform 3.0.1 and 3.1.0 enables remote authenticated attackers to bypass permission enforcement via the `checkUserPermission` function in the Permission Service RPC component. A proof-of-concept exploit (`poc_vuln1_failopen_authz.zip`) is publicly available on GitHub, lowering the barrier to exploitation. The vendor has not responded to the issue report filed at the project repository, leaving affected deployments without an official patch.
Missing authorization in wxiaoqi Spring-Cloud-Platform 3.0.1 and 3.1.0 enables remote authenticated attackers to bypass permission enforcement via the `checkUserPermission` function in the Permission Service RPC component. A proof-of-concept exploit (`poc_vuln1_failopen_authz.zip`) is publicly available on GitHub, lowering the barrier to exploitation. The vendor has not responded to the issue report filed at the project repository, leaving affected deployments without an official patch.