GHSA-rc42-6c7j-7h5r Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed

• Maven org.springframework.boot:spring-boot: <= 2.7.24.2 (no fix yet) • Maven org.springframework.boot:spring-boot: >= 3.1.0, <= 3.1.15.2 (no fix yet) • Maven org.springframework.boot:spring-boot: >= 3.2.0, <= 3.2.13.2 (no fix yet) • Maven org.springframework.boot:spring-boot: >= 3.3.0, < 3.3.11 → fixed in 3.3.11 • Maven org.springframework.boot:spring-boot: >= 3.4.0, < 3.4.5 → fixed in 3.4.5

EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: • You use Spring Security • EndpointRequest.to() has been used in a Spring Security chain configuration • The endpoint which EndpointRequest references is disabled or not exposed via web • Your application handles requests to /null and this path needs protection You are not affected if any of the following is true: • You don't use Spring Security • You don't use EndpointRequest.to() • The endpoint which EndpointRequest.to() refers to is enabled and is exposed • Your application does not handle requests to /null or this path does not need protection