CVE: 2023-20883 found in spring-boot-autoconfigure - Version: 2.3.1.RELEASE [JAVA]

[Rajkumarr77]

Veracode Software Composition Analysis

Attribute	Details
Library	spring-boot-autoconfigure
Description	Spring Boot AutoConfigure
Language	JAVA
Vulnerability	Denial Of Service (DoS)
Vulnerability description	spring-boot-autoconfigure is vulnerable to Denial Of Service (DoS). The vulnerability is applicable when the application has Spring MVC auto-configuration enabled and uses the Spring Boot welcome page, which can be either static or templated, and the application is deployed behind a proxy which caches the 404 responses. An attacker can cause the application to crash by submitting a request to the welcome page which the server is unable to properly respond to.
CVE	2023-20883
CVSS score	7.1
Vulnerability present in version/s	1.4.1.RELEASE-2.5.14
Found library version/s	2.3.1.RELEASE
Vulnerability fixed in version	2.5.15
Library latest version	4.0.0-M1
Fix

Links:

• https://sca.analysiscenter.veracode.com/vulnerability-database/libraries/1323?version=2.3.1.RELEASE
• https://sca.analysiscenter.veracode.com/vulnerability-database/vulnerabilities/40739
• Patch: spring-projects/spring-boot@d7ff379