5faaff38ba
## Description CVE-2024-38821 is an authorization-bypass affecting Spring WebFlux apps that apply non-permitAll rules to static resources. The fix for CVE-2024-38821 is in Spring Security 6.3.4+. [Ref](https://spring.io/security/cve-2024-38821) Mitigation Strategy: We are upgrading Spring Boot to 3.3.13 which officially manages Spring Security versions. Spring Security 6.3.10 is well beyond the minimum required 6.3.4+ ### Verification Verification Results: 1. Spring Security Version Check: ✅ SECURE Current Version: Spring Security 6.3.10 Vulnerable Range: 6.3.0-6.3.3 Status: ✅ NOT VULNERABLE - Version 6.3.10 is well beyond the vulnerable range 2. All Spring Security Components Verified: ✅ SECURE ✅ spring-security-web: 6.3.10 ✅ spring-security-oauth2-client: 6.3.10 ✅ spring-security-oauth2-core: 6.3.10 ✅ spring-security-oauth2-jose: 6.3.10 ✅ spring-security-config: 6.3.10 ✅ spring-security-crypto: 6.3.10 ✅ spring-security-test: 6.3.10 3. No Vulnerable Versions Detected: ✅ CLEAN ❌ No Spring Security 6.3.0-6.3.3 versions found ❌ No vulnerable Spring Security components detected Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="@tag.Sanity" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/17201170729> > Commit: d588e5da0afe52b94730871b77ada4ab9b92c20e > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=17201170729&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Sanity` > Spec: > <hr>Mon, 25 Aug 2025 07:17:32 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Upgraded Spring Boot parent to 3.3.13 to improve stability, compatibility, and maintenance. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|---|---|---|
| .cursor | ||
| .github | ||
| app | ||
| contributions | ||
| deploy | ||
| scripts | ||
| static | ||
| .coderabbit.yaml | ||
| .deepsource.toml | ||
| .editorconfig | ||
| .env.example | ||
| .gitignore | ||
| .imgbotconfig | ||
| .nojekyll | ||
| app.json | ||
| appsmith_events.md | ||
| appsmith_templates.md | ||
| ci-debug.sh | ||
| CODE_OF_CONDUCT.md | ||
| CODEOWNERS | ||
| CONTRIBUTING.md | ||
| depot.json | ||
| Dockerfile | ||
| heroku.yml | ||
| IssuesReport.md | ||
| LICENSE | ||
| README.md | ||
| SECURITY.md | ||
Organizations build custom applications like dashboards, admin panels, customer 360, IT automation, and service management tools to help their teams work more efficiently and effectively. Appsmith is an open-source low-code platform that streamlines custom application development, deployment, and maintenance. Learn more on our website.
Installation
There are two ways to start using Appsmith:
- Signup on Appsmith Cloud.
- Install Appsmith on your machine. See the installation guides below.
| Installation Methods | Documentation |
|---|---|
 |
Docker (Recommended) |
 |
Kubernetes |
 |
AWS AMI |
For other deployment options, see the Installation Guides documentation.
Development
To build and run Appsmith in your local dev environment, see Setup for local development.
Learning Resources
Need Help?
Appsmith Agents
Introducing a new agentic AI platform that integrates the latest AI models with private and proprietary data at scale — inside the tools and systems that teams use every day. Appsmith Agents expands generative AI’s capabilities for the millions of knowledge workers in sales, support, customer success, human resources, and other business teams. By giving continuous context to AI models, Appsmith Agents lets teams ask questions and configure automations specific to their business without model fine-tuning or complex RAG implementations. Visit appsmith.com/ai to learn more.
Contributing
We ❤️ our contributors. We're committed to fostering an open, welcoming, and safe environment in the community.
📕 We expect everyone participating in the community to abide by our Code of Conduct. Please read and follow it.
🤝 If you'd like to contribute, start by reading our Contribution Guide.
👾 Explore some good first issues.
Let's build great software together.
Top Contributors
License
Appsmith is licensed under the terms of Apache License 2.0.