The vulnerability stems from Spring Tools for Eclipse generating a shared secret used to authenticate DevTools remote‑restart uploads when the DevTools remote support is enabled. The secret is created with a non‑cryptographic pseudo‑random number generator, violating the requirement for cryptographically secure randomness (CWE‑338). Based on the description, it is inferred that an attacker who can establish a DevTools session could potentially upload arbitrary restarts or manipulate the remote application, leading to unauthorized code execution or configuration changes.

This flaw affects Spring Tools for Eclipse versions 5.2.0 and earlier, specifically when remote DevTools support is enabled for a deployment such as a Docker container or Cloud Foundry app. Nothing is reported about newer releases, so only systems running the affected versions require attention.

The CVSS score of 8.3 indicates a high severity, yet the EPSS score is below 1 %, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need access to the Spring Tools Boot Dashboard to enable remote DevTools and then exploit the weakly generated secret; the use of a non‑cryptographic PRNG may reduce the randomness of the secret, potentially increasing the risk of guessing or brute‑force attempts. This risk is higher for environments where DevTools remote support is exposed to untrusted users, but the overall exploitation likelihood remains low without that initial access.