Spring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry

2023-04-2021:33:27

Google

osv.dev

0.007 Low

EPSS

Percentile

79.4%

JSON

In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.

CPENameOperatorVersion
org.springframework.boot:spring-boot-actuator-autoconfigureeq2.3.2.RELEASE
org.springframework.boot:spring-boot-actuator-autoconfigureeq2.5.14
org.springframework.boot:spring-boot-actuator-autoconfigureeq2.7.0
org.springframework.boot:spring-boot-actuator-autoconfigureeq2.1.18.RELEASE
org.springframework.boot:spring-boot-actuator-autoconfigureeq2.2.13.RELEASE
org.springframework.boot:spring-boot-actuator-autoconfigureeq3.0.5
org.springframework.boot:spring-boot-actuator-autoconfigureeq2.2.12.RELEASE
org.springframework.boot:spring-boot-actuator-autoconfigureeq2.5.2
org.springframework.boot:spring-boot-actuator-autoconfigureeq2.5.7
org.springframework.boot:spring-boot-actuator-autoconfigureeq2.4.9

Name	Operator	Version
org.springframework.boot:spring-boot-actuator-autoconfigure	eq	2.3.2.RELEASE
org.springframework.boot:spring-boot-actuator-autoconfigure	eq	2.5.14
org.springframework.boot:spring-boot-actuator-autoconfigure	eq	2.7.0
org.springframework.boot:spring-boot-actuator-autoconfigure	eq	2.1.18.RELEASE
org.springframework.boot:spring-boot-actuator-autoconfigure	eq	2.2.13.RELEASE
org.springframework.boot:spring-boot-actuator-autoconfigure	eq	3.0.5
org.springframework.boot:spring-boot-actuator-autoconfigure	eq	2.2.12.RELEASE
org.springframework.boot:spring-boot-actuator-autoconfigure	eq	2.5.2
org.springframework.boot:spring-boot-actuator-autoconfigure	eq	2.5.7
org.springframework.boot:spring-boot-actuator-autoconfigure	eq	2.4.9