GHSA-mgvc-8q2h-5pgc
Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework.boot:spring-boot-starter-actuator | >= 4.0.0-M1, < 4.0.4 | 4.0.4 |
| Maven | org.springframework.boot:spring-boot-starter-actuator | >= 3.5.0, < 3.5.12 | 3.5.12 |
| Maven | org.springframework.boot:spring-boot-starter-actuator | >= 3.4.0, <= 3.4.13 | no fix listed |
| Maven | org.springframework.boot:spring-boot-starter-actuator | >= 3.0.0, <= 3.3.13 | no fix listed |
| Maven | org.springframework.boot:spring-boot-starter-actuator | <= 2.7.18 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.
References
External links from the advisory. They lead to third-party sites.