PT-2024-28235 · Unknown +1 · Spring Mvc +1

🗓️ 17 Nov 2024 00:00:00Reported by Positive TechnologiesType

Spring MVC DoS in controller methods using an @RequestBody byte[] parameter; affected versions are unspecified and no fix information is available.

Reporter	Title	Published	Views	Family All 46
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench	30 Oct 202520:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in spring-webmvc-5.3.27.jar	10 Jul 202508:59	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	3 Jun 202511:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilites in IBM Rational Build Forge.	2 Mar 202608:30	–	ibm
IBM Security Bulletins	Security Bulletin: Rational Test Virtualization Server and Rational Test Workbench are vulnerable to denial of service due to Spring MVC (CVE-2024-38828)	21 Mar 202518:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by vulnerabilities	27 Mar 202516:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM OpenPages for Cloud Pak for Data is Vulnerable to Multiple Spring Framework Vulnerabilities (CVE-2024-38828,CVE-2024-38820)	3 Nov 202502:13	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for December 2025.	12 Jan 202617:35	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring Web affect watsonx.data	22 Apr 202503:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Controller	4 Dec 202514:43	–	ibm

Source	Link
cve	www.cve.org/CVERecord
osv	www.osv.dev/vulnerability/UBUNTU-CVE-2024-38828
osv	www.osv.dev/vulnerability/CVE-2024-38828
security-tracker	www.security-tracker.debian.org/tracker/CVE-2024-38828
ubuntu	www.ubuntu.com/security/CVE-2024-38828
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
osv	www.osv.dev/vulnerability/GHSA-w3c8-7r8f-9jp8
security-tracker	www.security-tracker.debian.org/tracker/source-package/libspring-java
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-38828
github	www.github.com/spring-projects/spring-framework

18 Nov 2024 00:00Current

7.7High risk

Vulners AI Score7.7

CVSS 3.15.3

EPSS0.00076

SSVC