Description
Spring Boot-s ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker-s data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.
CVSS 5.3EPSS 0.094%Risque 0.53
Voir la source- Publication
- 2026-06-11 07:16:28
- Versions concernées
- >=4.0.0,<4.0.7, >=3.5.0,<3.5.15, >=3.4.0,<3.4.17, >=3.3.0,<3.3.20, >=2.7.0,<2.7.34
- Type
- Logiciel critique
- Vecteur
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L