A critical information disclosure vulnerability in Apache SkyWalking exposes sensitive database configuration data, potentially leading to unauthorized access to backend systems.

This vulnerability is caused by an insecure debugging endpoint that fails to implement authentication checks. An unauthenticated remote attacker can query the /debugging/config/dump URI to retrieve plaintext database credentials and configuration settings.

The exposure of database configuration information presents a high risk of unauthorized access to critical data stores. With a CVSS score of 7.5, this vulnerability facilitates lateral movement and data exfiltration, which could result in significant operational disruption and a breach of sensitive customer or corporate data.

Immediate Action: Upgrade Apache SkyWalking to version 10.4.0 or later immediately to remove the vulnerable debugging endpoint and secure sensitive configurations.

Proactive Monitoring: Review application access logs for any requests directed toward the /debugging/config/dump endpoint and monitor database authentication logs for suspicious login attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block all external access to the /debugging/config/ path until the software can be updated.

Public Exploit Available: Unknown

The severity of this disclosure necessitates immediate attention from security teams. Given that the vulnerability is easily exploitable over a network without authentication, organizations must prioritize patching to version 10.4.0 to prevent the compromise of backend database credentials and subsequent unauthorized system access.