Log in Start free

Vulnerability · Published Oct 18, 2024 · Assigned by vmware

CVE-2024-38820CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception

Low 3.1

In plain English

A low-severity security flaw in Spring from VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.6%top 50.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-javano fix listedDEBIAN-CVE-2024-38820
Debian:13libspring-javano fix listedDEBIAN-CVE-2024-38820
Debian:14libspring-javano fix listedDEBIAN-CVE-2024-38820
Mavenorg.springframework:spring-context6.1.14GHSA-4gc7-5j7h-4qph
Mavenorg.springframework:spring-contextno fix listedGHSA-4gc7-5j7h-4qph
Mavenorg.springframework:spring-contextno fix listedGHSA-4gc7-5j7h-4qph
Mavenorg.springframework:spring-webno fix listedGHSA-4gc7-5j7h-4qph
Mavenorg.springframework:spring-webno fix listedGHSA-4gc7-5j7h-4qph
Mavenorg.springframework:spring-web6.1.14GHSA-4gc7-5j7h-4qph
Ubuntu:25.10libspring-javano fix listedUBUNTU-CVE-2024-38820
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2024-38820
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2024-38820

Affected products (as reported)

VendorProductVersions
VMware Spring 5.3.x – before 5.3.416.0.x – before 6.0.256.1.x – before 6.1.14

Weakness: CWE-178 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References