Log in Start free

Vulnerability · Published Dec 4, 2024 · Assigned by vmware

CVE-2024-38829Spring LDAP sensitive data exposure for case-sensitive comparisons

Low 3.7

In plain English

A low-severity security flaw in Spring LDAP from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.4%top 69.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-javano fix listedDEBIAN-CVE-2024-38829
Debian:13libspring-javano fix listedDEBIAN-CVE-2024-38829
Debian:14libspring-javano fix listedDEBIAN-CVE-2024-38829
Mavenorg.springframework.ldap:spring-ldap-core3.2.8GHSA-mqvr-2rp8-j7h4
Mavenorg.springframework.ldap:spring-ldap-core2.4.4GHSA-mqvr-2rp8-j7h4
Ubuntu:25.10libspring-javano fix listedUBUNTU-CVE-2024-38829
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2024-38829
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2024-38829

Affected products (as reported)

VendorProductVersions
Spring Spring LDAP 2.4.0 – through 2.4.33.0.0 – through 3.0.93.1.0 – through 3.1.73.2.0 – through 3.2.70 – through 2.4.0

Weakness: CWE-178 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References