CVE-2024-38821

🗓️ 28 Oct 2024 07:06:13Reported by vmwareType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 386 Views🌐 WEB

Spring WebFlux application security bypass CVE-2024-3882

Reporter	Title	Published	Views	Family All 51
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for February 2025.	12 Mar 202511:26	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager	16 Dec 202507:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities that affects BigReplicate (CVE-2024-51504, CVE-2024-38821, CVE-2023-20863)	26 Aug 202520:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in spring-security-web-5.8.5.jar	8 Jul 202506:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for Nov 2024	26 Nov 202409:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for Jan 2025 - Multiple CVEs addressed	14 Feb 202505:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - AI Broker Component uses spring-security-web-6.3.3.jar which is vulnerable to this CVE-2024-38821	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring WebFlux, Jenkins, Spring Securiy, Spring Framework, and Node.js lodash might affect IBM Storage Defender Copy Data Management.	5 May 202618:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager	16 Dec 202505:55	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring WebFlux affects watsonx.data	27 Feb 202513:26	–	ibm

Vulners

Vulnrichment

Node

springsource spring_frameworkRange5.7–5.7.13

springsource spring_frameworkRange5.8–5.8.15

springsource spring_frameworkRange6.0–6.0.13

springsource spring_frameworkRange6.1–6.1.11

springsource spring_frameworkRange6.2–6.2.7

springsource spring_frameworkRange6.3–6.3.4

[
  {
    "defaultStatus": "affected",
    "packageName": "Spring Security",
    "product": "Spring",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "5.7.13",
        "status": "affected",
        "version": "5.7.x",
        "versionType": "Enterprise Support Only"
      },
      {
        "lessThan": "5.8.15",
        "status": "affected",
        "version": "5.8.x",
        "versionType": "Enterprise Support Only"
      },
      {
        "lessThan": "6.0.13",
        "status": "affected",
        "version": "6.0.x",
        "versionType": "Enterprise Support Only"
      },
      {
        "lessThan": "6.1.11",
        "status": "affected",
        "version": "6.1.x",
        "versionType": "Enterprise Support Only"
      },
      {
        "lessThan": "6.2.7",
        "status": "affected",
        "version": "6.2.x",
        "versionType": "OSS"
      },
      {
        "lessThan": "6.3.4",
        "status": "affected",
        "version": "6.3.x",
        "versionType": "OSS"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2024-38821
security	www.security.netapp.com/advisory/ntap-20250124-0006/

Parameter	Position	Path	Description	CWE
path	path	/css/../secret/secret-file.txt	Path traversal attack via static resource path that bypasses authentication to access a protected secret file	CWE-770

17 Jun 2026 07:41Current

9.1High risk

Vulners AI Score9.1

CVSS 3.19.1

EPSS0.01741

SSVC

CWE-770