Description
In Webbukkit Dynmap 3.0-beta-3 or below, due to a missing login check in servlet/MapStorageHandler.java, an attacker can see a map image without login even if victim enables login-required in setting.
Remediation
References
https://github.com/webbukkit/dynmap/pull/2475
https://github.com/webbukkit/dynmap/issues/2474
https://github.com/webbukkit/dynmap/commit/641f142cd3ccdcbfb04eda3059be22dd9ed93783
http://jvn.jp/en/jp/JVN89046645/index.html
Related Vulnerabilities
CVE-2020-8149 Vulnerability in npm package logkitty
CVE-2022-31150 Vulnerability in npm package undici
CVE-2014-0034 Vulnerability in maven package org.apache.cxf.services.sts:cxf-services-sts-core
CVE-2022-36272 Vulnerability in maven package net.mingsoft:ms-mcms
CVE-2017-12974 Vulnerability in maven package com.nimbusds:nimbus-jose-jwt