The Spring Boot language server component of Spring Tools for Eclipse versions 5.2.0 and earlier logs the raw values of the https_proxy, HTTPS_PROXY, http_proxy, and HTTP_PROXY environment variables at INFO level when creating outbound HTTP clients without an explicit http.proxy workspace setting. Since corporate proxy URLs often embed Basic-auth credentials (e.g., http://user:pass@proxy:8080), these credentials are written to log files without any redaction. Because these log files can be shared or accessed by other local users or processes, this behavior can result in the disclosure of sensitive proxy credentials. The vulnerability is identified as CWE-532 (Insertion of Sensitive Information into Log File).

The vulnerability can lead to the disclosure of sensitive proxy credentials embedded in environment variables via log files. This exposure is limited to local users or processes with access to the language server log files or to external parties if logs are shared (e.g., attached to bug reports). There is no indication of remote exploitation or impact on integrity or availability. The CVSS score is 3.3 (low severity), reflecting limited confidentiality impact and local attack vector with low privileges required.

No official patch or remediation level is currently provided by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid embedding sensitive credentials in proxy environment variables or restrict access to language server log files to prevent unauthorized disclosure. Consider configuring explicit http.proxy workspace settings to avoid logging environment variables.