In Spring Boot, an application that is deployed to Cloud Foundry could be susceptible to a security bypass.

Specifically, an application is vulnerable when all of the following are true:

• You have code that can handle requests that match /cloudfoundryapplication/**. Typically, this will be if there is a catch-all request mapping which matches /**.
• The application is deployed to Cloud Foundry.

NOTE: Applications using Spring Cloud Config Server can handle requests to /cloudfoundryapplication/** by default and can be vulnerable if deployed to Cloud Foundry.

An application is not vulnerable if any of the following is true:

• The application is not deployed to Cloud Foundry
• You have disabled Cloud Foundry actuator endpoints with management.cloudfoundry.enabled set to false.
• Your application does not have handler mappings that can handle requests to /cloudfoundryapplication/**.