Vulnerability · Published Dec 2, 2024 · Assigned by vmware
CVE-2024-38827Spring Security Authorization Bypass for Case Sensitive Comparisons
Medium 4.8
In plain English
A medium-severity authorization bypass via user-controlled key in Spring Security from Spring by VMware Tanzu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.4%top 68.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.security:spring-security-core | 5.7.14 | GHSA-q3v6-hm2v-pw99 |
| Maven | org.springframework.security:spring-security-core | 5.8.16 | GHSA-q3v6-hm2v-pw99 |
| Maven | org.springframework.security:spring-security-core | 6.0.14 | GHSA-q3v6-hm2v-pw99 |
| Maven | org.springframework.security:spring-security-core | 6.1.12 | GHSA-q3v6-hm2v-pw99 |
| Maven | org.springframework.security:spring-security-core | 6.2.8 | GHSA-q3v6-hm2v-pw99 |
| Maven | org.springframework.security:spring-security-core | 6.3.5 | GHSA-q3v6-hm2v-pw99 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring by VMware Tanzu | Spring Security | 5.7.0 - 5.7.13, 5.8.0 - 5.8.15, 6.0.0 - 6.0.13, 6.1.0 - 6.1.11, 6.2.0 - 6.2.7, 6.3.0 - 6.3.4, Older unsupported versions are also affected |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N