> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit

<AccordionGroup>
  <Accordion title="spring-actuator-fully-enabled">
    Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="spring-jsp-eval">
    A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
    <br />**OWASP**: <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="spring-sqli">
    Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    <br />**OWASP**: <br />- A01:2017 - Injection
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="spring-actuator-dangerous-endpoints-enabled">
    Spring Boot Actuators "\$...ACTUATORS" are enabled. Depending on the actuators, this can pose a significant security risk. Please double-check if the actuators are needed and properly secured.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="spring-actuator-fully-enabled-yaml">
    Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a severe security risk.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="spel-injection">
    A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-94: Improper Control of Generation of Code ('Code Injection')
    <br />**OWASP**: <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="spring-unvalidated-redirect">
    Application redirects a user to a destination URL specified by a user supplied parameter that is not validated.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="spring-csrf-disabled">
    CSRF protection is disabled for this configuration. This is a security risk.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-352: Cross-Site Request Forgery (CSRF)
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="spring-actuator-dangerous-endpoints-enabled-yaml">
    Spring Boot Actuator "\$ACTUATOR" is enabled. Depending on the actuator, this can pose a significant security risk. Please double-check if the actuator is needed and properly secured.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>
</AccordionGroup>