REDHAT-BUG-2463322: High severity Pivotal Software Spring Boot vulnerability
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.
Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Bootto a version that resolves this vulnerability.Fixed in 4.0.6
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2463322?
The severity of REDHAT-BUG-2463322 is classified as high with a score of 7.
How does REDHAT-BUG-2463322 allow unauthorized access?
REDHAT-BUG-2463322 allows unauthorized access due to ineffective default web security in Spring Boot when no custom security configuration is implemented.
What conditions must be met for REDHAT-BUG-2463322 to be exploitable?
For REDHAT-BUG-2463322 to be exploitable, the application must be a servlet-based web application without its own Spring Security configuration.
What version of Spring Boot is affected by REDHAT-BUG-2463322?
REDHAT-BUG-2463322 affects certain versions of Pivotal Software Spring Boot, particularly those relying on default security settings.
What should developers do to mitigate the risks of REDHAT-BUG-2463322?
Developers should implement a custom Spring Security configuration to mitigate the risks associated with REDHAT-BUG-2463322.