Spring Tools For Eclipse
Approved changes feed: RSS · Atom
cpe:2.3:a:spring:spring_tools_for_eclipse:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Spring (4c7a31af-cbd7-516f-b1ce-2d5f574797bc) |
|---|---|
| Product | Spring Tools For Eclipse (6c4cb5ad-fc56-52c5-8c6b-e84e42845bb7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-47858 |
vulnerable | 2026-09-16 04:34:01.467334 |
live information startup mode is vulnerable for remote code execution
HIGH (8)
Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution.
Affected Spring Products and Versions:
Spring Tools for Eclipse: 5.2.0 and earlier
Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier
Published: 2026-07-30T05:15:31.292Z
Updated: 2026-08-01T03:56:10.532Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-47882 |
vulnerable | 2026-09-16 04:34:00.553487 |
Spring Boot DevTools remote secret generated with a non-cryptographic PRNG
HIGH (8.3)
When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness.
Affected Spring Products and Versions:
Spring Tools for Eclipse: 5.2.0 and earlier
Published: 2026-07-30T05:26:07.335Z
Updated: 2026-08-01T03:56:08.233Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-47873 |
vulnerable | 2026-09-16 04:34:00.523944 |
Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces
HIGH (8)
The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricting them to loopback.
Affected Spring Products and Versions:
Spring Tools for Eclipse: 5.2.0 and earlier
Published: 2026-07-30T05:23:59.651Z
Updated: 2026-08-01T03:56:09.351Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.