GHSA-q2cj-h8fw-q4cc Spring Expression language property modification using Spring Cloud Gateway Server WebFlux

• Maven org.springframework.cloud:spring-cloud-gateway-server-webflux: >= 3.1.0, <= 3.1.10 (no fix yet) • Maven org.springframework.cloud:spring-cloud-gateway-server-webflux: >= 4.0.0, <= 4.1.10 (no fix yet) • Maven org.springframework.cloud:spring-cloud-gateway-server-webflux: >= 4.2.0, < 4.2.5 → fixed in 4.2.5 • Maven org.springframework.cloud:spring-cloud-gateway-server-webflux: >= 4.3.0, < 4.3.1 → fixed in 4.3.1

Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: • The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). • Spring Boot actuator is a dependency. • The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. • The actuator endpoints are available to attackers. • The actuator endpoints are unsecured.