This vulnerability (CWE-306) affects Spring Tools for Eclipse versions 5.2.0 and earlier, as well as Spring Tools for VSCode, Cursor, and Theia versions 2.2.0 and earlier. When Spring Boot applications are started with live information mode enabled, the running application becomes vulnerable to remote code execution via JMX due to missing authentication on critical functions. The CVSS 3.1 score is 8.0, indicating high severity, with attack vector being adjacent network, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An attacker with network access adjacent to the victim can exploit this vulnerability by leveraging JMX to execute arbitrary code remotely on the affected Spring Tools applications. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability requires user interaction but no privileges or authentication, making it a significant risk in environments where live information mode is enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable live information mode when starting Spring Boot applications in Spring Tools to prevent exposure to this vulnerability. Monitor vendor communications for updates and apply patches promptly once released.