CVE-2024-38820

Published: Oct 18, 2024Modified: Nov 29, 2024

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

Affected (3)

Products: Vmware: Spring Framework

Vmware

1 product

Spring Framework

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Vmware Spring Framework	From 5.3.0 to 5.3.41
Vmware Spring Framework	From 6.0.0 to 6.0.25
Vmware Spring Framework	From 6.1.0 to 6.1.14

Related CWEs

CWE-178

Improper Handling of Case Sensitivity

The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

References (2)

https://spring.io/security/cve-2024-38820

Source: security@vmware.com

Vendor Advisory

https://security.netapp.com/advisory/ntap-20241129-0003/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.