CVE-2024-38820

🗓️ 18 Oct 2024 05:39:05Reported by vmwareType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 403 Views🌐 WEB

Spring Framework DataBinder Case Sensitive Match Exception Fi

Reporter	Title	Published	Views	Family All 114
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Spring may affect IBM Business Automation Workflow - CVE-2024-38820, CVE-2025-22233	8 Oct 202515:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	7 Mar 202515:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Content Navigator consumes vulnerable spring framework library	23 Oct 202511:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT uses spring-context-5.3.39.jar which is vulnerable to CVE-2024-38820.	7 Apr 202519:13	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.0.2	21 Jun 202513:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a security weakness in Spring Framework [CVE-2024-38820]	27 Feb 202516:58	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilites in IBM Rational Build Forge.	2 Mar 202608:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana (OnPrem) is affected by multiple security vulnerabilities	29 Apr 202519:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services vulnerable to spring-context-6.2.3.jar (CVE-2025-22233)	24 Jun 202516:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by vulnerabilities	27 Mar 202516:26	–	ibm

NVD

Node

vmware spring_frameworkRange5.3.0–5.3.41

vmware spring_frameworkRange6.0.0–6.0.25

vmware spring_frameworkRange6.1.0–6.1.14

[
  {
    "defaultStatus": "affected",
    "packageName": "Spring Framework",
    "product": "Spring",
    "vendor": "VMware",
    "versions": [
      {
        "lessThan": "5.3.41",
        "status": "affected",
        "version": "5.3.x",
        "versionType": "Enterprise Support Only"
      },
      {
        "lessThan": "6.0.25",
        "status": "affected",
        "version": "6.0.x",
        "versionType": "Enterprise Support Only"
      },
      {
        "lessThan": "6.1.14",
        "status": "affected",
        "version": "6.1.x",
        "versionType": "OSS"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2024-38820
security	www.security.netapp.com/advisory/ntap-20241129-0003/

Parameter	Position	Path	Description	CWE
ADMINID	query param	/user	Locale-dependent toLowerCase bypass of disallowedFields in DataBinder (Turkish locale may bypass protection for adminId).	CWE-178
AdminId	query param	/user	Locale-dependent toLowerCase bypass of disallowedFields in DataBinder (Turkish locale may bypass protection for adminId).	CWE-178
ADMİNID	query param	/user	Locale-dependent toLowerCase bypass of disallowedFields in DataBinder (Turkish locale may bypass protection for adminId).	CWE-178
adminId	query param	/user	Locale-dependent toLowerCase bypass of disallowedFields in DataBinder (Turkish locale may bypass protection for adminId).	CWE-178

29 Nov 2024 12:15Current

3.9Low risk

Vulners AI Score3.9

CVSS 3.13.1 - 5.3

EPSS0.01514

SSVC

CWE-178