Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the env actuator endpoint when no allow list is enforced for property keys. An attacker can modify arbitrary environment properties by sending crafted requests to the writable endpoint. Note: This is only...

GHSA-W3X5-427H-WFQ6 Spring Boot Admins integrated notifier support allows arbitrary code execution

Impact All users who run Spring Boot Admin Server, having enabled Notifiers e.g. Teams-Notifier and write access to environment variables via UI are possibly affected. Patches In the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 the issue is fixed by implementing SimpleExecutionConte...