The vulnerability allows an attacker to read the Spring Boot DevTools remote secret, which is stored as a plain string in Eclipse launch configuration files. With that secret, the attacker can target the DevTools remote restart endpoint and upload arbitrary class bytes, enabling remote code execution on the protected Spring Boot application. This flaw stems from improper handling of sensitive credentials, classified as CWE‑312. How an attacker can read the secret is inferred from the storage of the secret as a cleartext attribute in the launch configuration files.

Spring Tools for Eclipse versions 5.2.0 and earlier are affected. Users of these versions should verify their installed product and version number.

The CVSS score of 4.4 indicates a moderate overall severity, while an EPSS score of less than 1% shows a low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector, inferred from the fact that the secret is stored in cleartext XML files, requires the attacker to access the .launch file (through direct filesystem read, a workspace backup, or a shared VCS repository) in order to extract the cleartext secret and then use it to invoke the remote restart endpoint. Once the secret is acquired, remote code execution can be achieved without further authentication.