This vulnerability in erzhongxmu JeeWMS up to commit 141740afb2ba14d441c82a833d0a418d07ca2d69 allows remote attackers to cause information disclosure via manipulation of the /base-boot/actuator endpoint in the Boot Actuator Endpoint component. The weakness arises from improper handling of requests to this endpoint, potentially exposing sensitive information. The product uses a rolling release approach, complicating version tracking. The vendor was notified but has not provided any response or patch. Public exploit code is available, increasing the risk of exploitation despite no known active attacks reported.

Successful exploitation can lead to unauthorized disclosure of information from the affected system. This could aid attackers in gathering sensitive data that may facilitate further attacks or reconnaissance. The medium CVSS score reflects a moderate impact due to information disclosure without direct integrity or availability consequences. No confirmed exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor or community. Until a patch is released, consider restricting access to the /base-boot/actuator endpoint or implementing network-level controls to limit exposure. Avoid exposing this endpoint to untrusted networks where possible.