Description
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Spring Spring Security
Default version status: unaffected
4.0.0 to ≤ 4.0.3affected3.5.0 to ≤ 3.5.11affected3.4.0 to ≤ 3.4.14affected3.3.0 to ≤ 3.3.17affected2.7.0 to ≤ 2.7.31affected