org.springframework.boot/spring-boot-actuator-autoconfigure vulnerabilities

Latest org.springframework.boot/spring-boot-actuator-autoconfigure CVEs

Newest publication first

1. CVE-2023-20873 Spring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry

   Published 2023-04-20

   Critical·CVSS 9.8 EPSS 1.1%

   In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.