Description
The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Metrics
No CVSS score has been published yet.
Weakness enumeration
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache TomEE | >= 7.0.0-M2, < 10.0.0-M1; >= 10.0.0-M1, < 10.3.0; >= 11.0.0-M1, < 11.0.0-M2 |
References
Timeline
- Published
- Nov 10, 2026
- Last modified
- Nov 12, 2026
- NVD status
- Awaiting Analysis