CVE-2023-20873

A flaw was found in Spring Boot. This targets specifically ‘spring-boot-actuator-autoconfigure’ package. This issue occurs when an application is deployed to Cloud Foundry, which could be susceptible to a security bypass. Specifically, an application is vulnerable when all of the following are true: * You have code that can handle requests that match /cloudfoundryapplication/. Typically, this will be if there is a catch-all request mapping which matches /. * The application is deployed to Cloud Foundry. An application is not vulnerable if any of the following is true: * The application is not deployed to Cloud Foundry * You have disabled Cloud Foundry actuator endpoints with management.cloudfoundry.enabled set to false. * Your application does not have handler mappings that can handle requests to /cloudfoundryapplication/**.

Mitigation

Disable Cloud Foundry actuator endpoints by setting 'management.cloudfoundry.enabled' to false.