WaratekVRT Sign in

CVE-2021-21234 spring-boot-actuator-logview

Affected softwarespring-boot-actuator-logview
Severity7.7 High CVSS 3.1 3 scores
Fixed in0.2.13
WeaknessPath traversal (CWE-22)
Published5 Jan 2021
Updated17 Jun 2026

Description

spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that filename=../somefile would not work), the base folder parameter was not sufficiently checked, so that filename=somefile&base=../ could access a file outside the logging base directory). The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 2 citations · honeypot sightings · 1 exploit · earliest 2023-11-16.
  • CISA Vulnrichment no assessment published
  • Indexed PoC 3 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2021-06-08.
  • EPSS 21% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2021-21234 in VulnCheck (free account).

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 520 days 2023-11-16 to 2026-11-10
Honeypot sighting VulnCheck canaries Exploitation attempts seen on 21 days 2026-04-30 to 2026-11-01
Reported exploitation go.catonetworks.com /rs/245-RJK-441/images/CATO_CTRL_Report_Q3_2024.pdf 2024-11-20
Reported exploitation app.crowdsec.net /cti/cve-explorer/CVE-2021-21234 2025-06-07
Exploit reference VulnCheck XDB 87b651f78c86 Exploit type: infoleak 2021-10-19

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC xiaojiangxl/CVE-2021-21234 5 2021-10-19
GitHub PoC Directory traversal vulnerability in the spring-boot-actuator-logview library 1 2021-06-08
Nuclei Spring Boot Actuator Logview Directory Traversal

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A vulnerability class already blocked by an ARMR security rule
Finding Protected by Waratek's ARMR path-traversal security rule, which blocks this class of attack at the JVM level without a rule written for this CVE specifically. The CVE's weakness is CWE-22: Path Traversal.
Candidate fix https://github.com/lukashinsch/spring-boot-actuator-logview/commit/1c76e1ec3588c9f39e1a94bf27b5ff56eb8b17d6 : a commit: the change itself

How to mitigate CVE-2021-21234

Upgrade spring-boot-actuator-logview to 0.2.13 or later. Until you can, Waratek RASP blocks exploitation with its path traversal rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

7.7 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.7 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N security-advisories@github.com Secondary published
CVSS 3.1 7.7 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N NVD Primary
CVSS 2.0 4.0 none AV:N/AC:L/Au:S/C:P/I:N/A:N NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
eu.hinsch:spring-boot-actuator-logview 0 0.2.13 unbounded

Products and versions

2 products, 2 version entries
SourceVendorProductSchemeAffected versions
osv eu.hinsch spring-boot-actuator-logview generic ＜ 0.2.13
nvd spring-boot-actuator-logview project spring-boot-actuator-logview generic ≤ 0.2.12

References

URLTags
https://github.com/lukashinsch/spring-boot-actuator-logview/commit/1c76e1ec3588c9f39e1a94bf27b5ff56eb8b17d6 commit
https://github.com/lukashinsch/spring-boot-actuator-logview/security/advisories/GHSA-p4q6-qxjx-8jgp WEB
https://github.com/lukashinsch/spring-boot-actuator-logview/commit/760acbb939a8d1f7d1a7dfcd51ca848eea04e772 WEB
https://search.maven.org/artifact/eu.hinsch/spring-boot-actuator-logview WEB

Timeline
Published2021-01-05By the CVE Program.
VulnCheck KEV: earliest evidence2023-11-16Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-10Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.