Interinfo DreamMaker Missing Authentication Vulnerability in Administrative Functionality

A vulnerability allowing missing authentication for critical functions has been identified in Interinfo DreamMaker versions prior to October 22, 2025. This issue resides in the /servlet/baServer3 endpoint, where remote attackers can access administrative functionalities without authentication.

Impact

Exploitation of this vulnerability allows unauthorized access to administrative functions, potentially leading to unauthorized changes or management of the application.

Remediation

It is recommended to configure network firewalls, load balancers, or Access Control Lists (ACLs) to restrict access to the affected endpoint /servlet/baServer3. External network connections should be completely blocked, allowing access only from trusted internal management IP addresses.