org.springframework.boot:spring-boot-actuator-autoconfigure@2.6.2 vulnerabilities

Affected versions of this package are vulnerable to Access Restriction Bypass due to improper implementation of wildcard pattern matching.

An application is vulnerable when all of the following are true:

1. Users have code that can handle requests matching /cloudfoundryapplication/**. Typically, this will be if there is a catch-all request mapping which matches /**

2. The application is deployed to Cloud Foundry.

Note: Applications using Spring Cloud Config Server can handle requests to /cloudfoundryapplication/** by default and can be vulnerable if deployed to Cloud Foundry.

An application is not vulnerable if any of the following is true:

1. The application is not deployed to Cloud Foundry

2. Users have disabled Cloud Foundry actuator endpoints with management.cloudfoundry.enabled set to false

3. The application does not have handler mappings that can handle requests to /cloudfoundryapplication/**

Upgrade org.springframework.boot:spring-boot-actuator-autoconfigure to version 2.5.15, 2.6.15, 2.7.11, 3.0.6 or higher.