CVE-2026-59327

{"id": "CVE-2026-59327", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59327", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T13:43:23.656304Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "Spring", "product": "Spring Tools for Eclipse", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "5.2.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-30T06:25:55.797", "references": [{"url": "https://spring.io/security/cve-2026-59327", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain string attribute on the \"Spring Boot DevTools Client\" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the user marks the configuration as a shared file, directly into the project tree where it can be committed to version control. This secret is the sole credential protecting the DevTools remote restart/reload endpoint, which accepts and executes arbitrary class bytes on the target application. Anyone able to read the .launch file (via filesystem access, a workspace backup, or a shared VCS repository) can extract the secret and use it to achieve remote code execution against the associated Spring Boot application.\nAffected Spring Products and Versions:\nSpring Tools for Eclipse: 5.2.0 and earlier"}, {"lang": "es", "value": "Spring Tools para Eclipse almacena el secreto remoto de Spring Boot DevTools (spring.devtools.remote.secret) como un atributo de cadena de texto plano en la configuraci\u00f3n de lanzamiento \u2019Spring Boot DevTools Client\u2019. Eclipse persiste los atributos de configuraci\u00f3n de lanzamiento como XML en texto claro, ya sea en los metadatos del espacio de trabajo o, si el usuario marca la configuraci\u00f3n como un archivo compartido, directamente en el \u00e1rbol del proyecto donde puede ser enviado al control de versiones. Este secreto es la \u00fanica credencial que protege el punto final remoto de reinicio/recarga de DevTools, que acepta y ejecuta bytes de clase arbitrarios en la aplicaci\u00f3n objetivo. Cualquiera que pueda leer el archivo .launch (a trav\u00e9s de acceso al sistema de archivos, una copia de seguridad del espacio de trabajo o un repositorio VCS compartido) puede extraer el secreto y usarlo para lograr ejecuci\u00f3n remota de c\u00f3digo contra la aplicaci\u00f3n Spring Boot asociada.\nProductos y versiones de Spring afectados:\nSpring Tools para Eclipse: 5.2.0 y anteriores"}], "lastModified": "2026-10-23T22:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:broadcom:spring_tools:*:*:*:*:*:eclipse:*:*", "vulnerable": true, "matchCriteriaId": "32B3B8F5-9BB0-496A-87C0-161B75ABE2F0", "versionEndExcluding": "5.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}