CVE-2024-3928 MEDIUM

CVE-2024-3928: Dromara open-capacity-platform auth-server heapdump information disclosure

Vendor Dromara
Product open-capacity-platform
Weakness CWE-200 · Info exposure
Published April 17, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

A vulnerability was found in Dromara open-capacity-platform 2.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /actuator/heapdump of the component auth-server. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261367.

Key dates

02Disclosure timeline

April 17, 2024 CVE published
August 1, 2024 Record updated