Spring

Spring Boot security — dependency CVEs, Actuator exposure, and authorization

Spring (Spring Boot) is an enterprise staple. Incident types: (1) known dependency CVEs (a widely-inherited foundation flaw like Log4Shell — judge by the running version and patch fast), (2) exposed management/diagnostic endpoints like Actuator (info leak / operation), (3) missing Spring Security authorization (authenticated but weak permission checks), (4) unsafe deserialization. Defenses: machine-monitor dependency CVEs and patch fast, lock down Actuator/management surfaces, make authorization explicit, don't deserialize untrusted data.