Threats tagged 'ghsa-8v8j-3hxp-93wr'

Spring Boot versions 4.0.0 through 4.0.5 have a critical security vulnerability where the default web security filter chain lacks authorization rules under specific conditions. This flaw allows unauthorized access to all endpoints if the application is servlet-based, relies on the default security configuration without custom Spring Security settings, depends on spring-boot-actuator-autoconfigure, and does not depend on spring-boot-health. The issue is fixed in version 4.0.6.