Vulnerable Library - spring-boot-starter-actuator-2.7.1.jar
Starter for using Spring Boot's Actuator which provides production ready features to help you monitor and manage your application
Library home page: https://spring.io/projects/spring-boot
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot-starter-actuator/2.7.1/spring-boot-starter-actuator-2.7.1.jar
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2023-20873
Vulnerable Library - spring-boot-actuator-autoconfigure-2.7.1.jar
Spring Boot Actuator AutoConfigure
Library home page: https://spring.io/projects/spring-boot
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot-actuator-autoconfigure/2.7.1/spring-boot-actuator-autoconfigure-2.7.1.jar
Dependency Hierarchy:
- spring-boot-starter-actuator-2.7.1.jar (Root Library)
- ❌ spring-boot-actuator-autoconfigure-2.7.1.jar (Vulnerable Library)
Found in base branch: main
Reachability Analysis
This vulnerability is potentially reachable
org.owasp.webgoat.container.WebSecurityConfig (Application)
-> org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$1 (Extension)
-> org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration (Extension)
-> org.springframework.boot.actuate.autoconfigure.cloudfoundry.servlet.CloudFoundryActuatorAutoConfiguration$IgnoredCloudFoundryPathsWebSecurityCustomizer (Extension)
-> org.springframework.boot.actuate.autoconfigure.cloudfoundry.servlet.CloudFoundryActuatorAutoConfiguration (Extension)
-> ❌ org.springframework.boot.actuate.autoconfigure.cloudfoundry.servlet.CloudFoundryActuatorAutoConfiguration$IgnoredCloudFoundryPathsWebSecurityConfiguration (Vulnerable Component)
Vulnerability Details
In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.
Publish Date: 2023-04-20
URL: CVE-2023-20873
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 1.122%
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2023-20873
Release Date: 2023-04-20
Fix Resolution (org.springframework.boot:spring-boot-actuator-autoconfigure): 2.7.12
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-actuator): 2.7.12
In order to enable automatic remediation, please create workflow rules
CVE-2026-22733
Vulnerable Libraries - spring-boot-starter-actuator-2.7.1.jar, spring-boot-actuator-autoconfigure-2.7.1.jar
spring-boot-starter-actuator-2.7.1.jar
Starter for using Spring Boot's Actuator which provides production ready features to help you monitor and manage your application
Library home page: https://spring.io/projects/spring-boot
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot-starter-actuator/2.7.1/spring-boot-starter-actuator-2.7.1.jar
Dependency Hierarchy:
- ❌ spring-boot-starter-actuator-2.7.1.jar (Vulnerable Library)
spring-boot-actuator-autoconfigure-2.7.1.jar
Spring Boot Actuator AutoConfigure
Library home page: https://spring.io/projects/spring-boot
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot-actuator-autoconfigure/2.7.1/spring-boot-actuator-autoconfigure-2.7.1.jar
Dependency Hierarchy:
- spring-boot-starter-actuator-2.7.1.jar (Root Library)
- ❌ spring-boot-actuator-autoconfigure-2.7.1.jar (Vulnerable Library)
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.
Publish Date: 2026-03-19
URL: CVE-2026-22733
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.36%
CVSS 3 Score Details (8.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-mgvc-8q2h-5pgc
Release Date: 2026-03-19
Fix Resolution: org.springframework.boot:spring-boot-starter-actuator:4.0.4,org.springframework.boot:spring-boot-starter-actuator:3.5.12
CVE-2025-22235
Vulnerable Library - spring-boot-actuator-autoconfigure-2.7.1.jar
Spring Boot Actuator AutoConfigure
Library home page: https://spring.io/projects/spring-boot
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot-actuator-autoconfigure/2.7.1/spring-boot-actuator-autoconfigure-2.7.1.jar
Dependency Hierarchy:
- spring-boot-starter-actuator-2.7.1.jar (Root Library)
- ❌ spring-boot-actuator-autoconfigure-2.7.1.jar (Vulnerable Library)
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.
Your application may be affected by this if all the following conditions are met:
- You use Spring Security
- EndpointRequest.to() has been used in a Spring Security chain configuration
- The endpoint which EndpointRequest references is disabled or not exposed via web
- Your application handles requests to /null and this path needs protection
You are not affected if any of the following is true:
- You don't use Spring Security
- You don't use EndpointRequest.to()
- The endpoint which EndpointRequest.to() refers to is enabled and is exposed
- Your application does not handle requests to /null or this path does not need protection
Publish Date: 2025-04-28
URL: CVE-2025-22235
Threat Assessment
Exploit Maturity: Functional
EPSS: 0.415%
CVSS 3 Score Details (7.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2025-04-24
Fix Resolution: https://github.com/spring-projects/spring-boot.git - v3.4.5,https://github.com/spring-projects/spring-boot.git - v3.3.11,org.springframework.boot:spring-boot-actuator-autoconfigure:3.4.5,org.springframework.boot:spring-boot-actuator-autoconfigure:3.3.11
CVE-2023-34055
Vulnerable Library - spring-boot-actuator-2.7.1.jar
Spring Boot Actuator
Library home page: https://spring.io/projects/spring-boot
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot-actuator/2.7.1/spring-boot-actuator-2.7.1.jar
Dependency Hierarchy:
- spring-boot-starter-actuator-2.7.1.jar (Root Library)
- spring-boot-actuator-autoconfigure-2.7.1.jar
- ❌ spring-boot-actuator-2.7.1.jar (Vulnerable Library)
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
- the application uses Spring MVC or Spring WebFlux
- org.springframework.boot:spring-boot-actuator is on the classpath
Publish Date: 2023-11-28
URL: CVE-2023-34055
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 1.219%
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2023-34055
Release Date: 2023-11-28
Fix Resolution (org.springframework.boot:spring-boot-actuator): 2.7.18
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-actuator): 2.7.18
In order to enable automatic remediation, please create workflow rules
CVE-2026-40984
Vulnerable Library - micrometer-core-1.9.1.jar
Core module of Micrometer containing instrumentation API and implementation
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/micrometer/micrometer-core/1.9.1/micrometer-core-1.9.1.jar
Dependency Hierarchy:
- spring-boot-starter-actuator-2.7.1.jar (Root Library)
- ❌ micrometer-core-1.9.1.jar (Vulnerable Library)
Found in base branch: main
Vulnerability Details
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Affected versions:
micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.
micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
Publish Date: 2026-06-09
URL: CVE-2026-40984
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.637%
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-40984
Release Date: 2026-06-09
Fix Resolution: io.micrometer:micrometer-core:1.16.6,io.micrometer:micrometer-core:1.15.12,https://github.com/micrometer-metrics/micrometer.git - v1.15.12,io.micrometer:micrometer-jetty12:1.15.12,io.micrometer:micrometer-jetty11:1.15.12,io.micrometer:micrometer-jetty12:1.16.6,https://github.com/micrometer-metrics/micrometer.git - v1.16.6,io.micrometer:micrometer-jetty11:1.16.6
In order to enable automatic remediation for this issue, please create workflow rules
Starter for using Spring Boot's Actuator which provides production ready features to help you monitor and manage your application
Library home page: https://spring.io/projects/spring-boot
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot-starter-actuator/2.7.1/spring-boot-starter-actuator-2.7.1.jar
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - spring-boot-actuator-autoconfigure-2.7.1.jar
Spring Boot Actuator AutoConfigure
Library home page: https://spring.io/projects/spring-boot
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot-actuator-autoconfigure/2.7.1/spring-boot-actuator-autoconfigure-2.7.1.jar
Dependency Hierarchy:
Found in base branch: main
Reachability Analysis
This vulnerability is potentially reachable
Vulnerability Details
In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.
Publish Date: 2023-04-20
URL: CVE-2023-20873
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 1.122%
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2023-20873
Release Date: 2023-04-20
Fix Resolution (org.springframework.boot:spring-boot-actuator-autoconfigure): 2.7.12
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-actuator): 2.7.12
In order to enable automatic remediation, please create workflow rules
Vulnerable Libraries - spring-boot-starter-actuator-2.7.1.jar, spring-boot-actuator-autoconfigure-2.7.1.jar
spring-boot-starter-actuator-2.7.1.jar
Starter for using Spring Boot's Actuator which provides production ready features to help you monitor and manage your application
Library home page: https://spring.io/projects/spring-boot
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot-starter-actuator/2.7.1/spring-boot-starter-actuator-2.7.1.jar
Dependency Hierarchy:
spring-boot-actuator-autoconfigure-2.7.1.jar
Spring Boot Actuator AutoConfigure
Library home page: https://spring.io/projects/spring-boot
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot-actuator-autoconfigure/2.7.1/spring-boot-actuator-autoconfigure-2.7.1.jar
Dependency Hierarchy:
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.
Publish Date: 2026-03-19
URL: CVE-2026-22733
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.36%
CVSS 3 Score Details (8.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-mgvc-8q2h-5pgc
Release Date: 2026-03-19
Fix Resolution: org.springframework.boot:spring-boot-starter-actuator:4.0.4,org.springframework.boot:spring-boot-starter-actuator:3.5.12
Vulnerable Library - spring-boot-actuator-autoconfigure-2.7.1.jar
Spring Boot Actuator AutoConfigure
Library home page: https://spring.io/projects/spring-boot
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot-actuator-autoconfigure/2.7.1/spring-boot-actuator-autoconfigure-2.7.1.jar
Dependency Hierarchy:
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.
Your application may be affected by this if all the following conditions are met:
You are not affected if any of the following is true:
Publish Date: 2025-04-28
URL: CVE-2025-22235
Threat Assessment
Exploit Maturity: Functional
EPSS: 0.415%
CVSS 3 Score Details (7.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2025-04-24
Fix Resolution: https://github.com/spring-projects/spring-boot.git - v3.4.5,https://github.com/spring-projects/spring-boot.git - v3.3.11,org.springframework.boot:spring-boot-actuator-autoconfigure:3.4.5,org.springframework.boot:spring-boot-actuator-autoconfigure:3.3.11
Vulnerable Library - spring-boot-actuator-2.7.1.jar
Spring Boot Actuator
Library home page: https://spring.io/projects/spring-boot
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot-actuator/2.7.1/spring-boot-actuator-2.7.1.jar
Dependency Hierarchy:
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
Publish Date: 2023-11-28
URL: CVE-2023-34055
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 1.219%
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2023-34055
Release Date: 2023-11-28
Fix Resolution (org.springframework.boot:spring-boot-actuator): 2.7.18
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-actuator): 2.7.18
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - micrometer-core-1.9.1.jar
Core module of Micrometer containing instrumentation API and implementation
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/micrometer/micrometer-core/1.9.1/micrometer-core-1.9.1.jar
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Affected versions:
micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.
micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
Publish Date: 2026-06-09
URL: CVE-2026-40984
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.637%
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-40984
Release Date: 2026-06-09
Fix Resolution: io.micrometer:micrometer-core:1.16.6,io.micrometer:micrometer-core:1.15.12,https://github.com/micrometer-metrics/micrometer.git - v1.15.12,io.micrometer:micrometer-jetty12:1.15.12,io.micrometer:micrometer-jetty11:1.15.12,io.micrometer:micrometer-jetty12:1.16.6,https://github.com/micrometer-metrics/micrometer.git - v1.16.6,io.micrometer:micrometer-jetty11:1.16.6
In order to enable automatic remediation for this issue, please create workflow rules