Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.

More precisely, an application can be vulnerable when all the following are true:

• The application uses Spring MVC or Spring WebFlux.
• The application has configured several resource handlers, using different resource locations.
• At least one of the resource handlers requires authentication to access resources.
• The application has configured a shared cache for these configurations.

When all the conditions above are met, an attacker can get access to a protected resource if a publicly available resource with the same name was resolved first and cached.