This vulnerability arises from the use of weak pseudorandom number generators in Spring Boot's random value property source. Specifically, the ${random.value} property produces values that are not cryptographically secure and therefore should not be used for generating secrets. Numeric random values such as ${random.int} and ${random.long} are also predictable and unsuitable for secret generation. The issue affects Spring Boot versions 2.7.0 to 2.7.32, 3.3.0 to 3.3.18, 3.4.0 to 3.4.15, 3.5.0 to 3.5.13, and 4.0.0 to 4.0.5. Fixed versions include 2.7.33, 3.3.19, 3.4.16, 3.5.14, and 4.0.6. The vulnerability is identified as CWE-330 (Use of Insufficiently Random Values).

The impact is limited to the potential exposure of secrets generated using weak random values, which could lead to reduced confidentiality and integrity of those secrets. The CVSS score of 4.8 reflects a medium severity with low confidentiality and integrity impact and no availability impact. There are no known exploits in the wild.

Fixed versions are available: upgrade to Spring Boot 2.7.33, 3.3.19, 3.4.16, 3.5.14, or 4.0.6 or later. Avoid using ${random.value}, ${random.int}, and ${random.long} for generating secrets. Use ${random.uuid} or other cryptographically secure random generators instead. Since a fix is available, upgrading to a patched version is the recommended remediation.