ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +2418 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-core (>=6.3.0, <=6.3.4)

org.springframework.security:spring-security-core MAVEN version =6.3.0, =cloud-0.1, =1.3.0, =1.0.0, =1.0.0, =0.0.1, =1.0.42, =1.0.45 and more Source cves: CVE-2024-38827 Source advisory: OSV:GHSA-Q3V6-HM2V-PW99...

org.springframework.security:spring-security-acl (3.1.5.release), org.springframework.security:spring-security-aspects (3.1.5.release) +7 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-core (3.1.5.release)

org.springframework.security:spring-security-core MAVEN version 3.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.springframework.security:spring-security-acl...

ba.jamax.util:jamax-rest (>=1.3.1-release, <=1.3.4-release), ch.rasc:wampspring-security (1.1.1) +31 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-core (4.0.0.release)

org.springframework.security:spring-security-core MAVEN version 4.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - ba.jamax.util:jamax-rest =1.3.1-release, =2.5.2,...

com.arsframework:ars-module-cms (>=1.0.0, <=1.1.4), com.arsframework:ars-module-educate (>=1.0.0, <=1.1.0) +186 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-core (3.1.3.release)

org.springframework.security:spring-security-core MAVEN version 3.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.arsframework:ars-module-cms =1.0.0, =1.0.0, =1.0....

au.csiro.pathling:fhir-server (>=5.3.1, <=6.4.2), au.org.consumerdatastandards:data-holder (>=2.3.0, <=2.4.1) +2331 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-web (>=5.7.0, <=5.7.13)

org.springframework.security:spring-security-web MAVEN version =5.7.0, =5.3.1, =2.3.0, =2.4.1 - au.org.consumerdatastandards:mock-data-holder-java 2.6.0 - br.com.m4rc310:br-com-m4rc310-graphql 1.0.1 - br.com.m4rc310:br-com-m4rc310-libs 1.0.1 - br.com.m4rc310:br-com-m4rc310-starter 1.0.1 -...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.11), am.ik.home:uaa-client (>=1.3.0, <=1.9.0) +1136 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-config (>=4.2.0.release, <=4.2.20.release)

org.springframework.security:spring-security-config MAVEN version =4.2.0.release, =0.1.8, =1.3.0, =1.3.0, =1.3.0, =0.3, =1.1.1, =0.0.1, =0.2.0, =1.0.3, =1.0.5, =0.0.1, =1.0.1.u1 and more Source cves: CVE-2024-38827 Source advisory: MEND:CVE-2024-38827...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.11), am.ik.home:uaa-client (>=1.3.0, <=1.9.0) +1289 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-web (>=4.2.0.release, <=4.2.20.release)

org.springframework.security:spring-security-web MAVEN version =4.2.0.release, =0.1.8, =1.3.0, =1.3.0, =1.3.0, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 - at.researchstudio.sat:won-utils-crawl 0.3 and mo...

com.lt-peacock:webdbviewer (>=1.0.0, <=1.0.2), ee.telekom.workflow:workflow-web (>=1.5.0, <=1.6.3) +5 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-taglibs (>=5.7.1, <=5.7.13)

org.springframework.security:spring-security-taglibs MAVEN version =5.7.1, =1.0.0, =1.5.0, =4.7.0, =4.7.0, =5.2.7, =5.7.2.release, =5.7.2.release, =5.7.4.release Source cves: CVE-2024-38827 Source advisory: MEND:CVE-2024-38827...

com.kakawait:cas-security-dynamic-service-resolver (>=0.1.0, <=0.4.0), com.kakawait:cas-security-spring-boot-autoconfigure (>=0.1.0, <=0.3.2) +9 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-cas (>=4.2.2.release, <=4.2.14.release)

org.springframework.security:spring-security-cas MAVEN version =4.2.2.release, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =9.4.0.10, =2.3.0, =2.3.0, =5.20.2, =5.21.1, =5.22.7 Source cves: CVE-2024-38827 Source advisory: MEND:CVE-2024-38827...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +9745 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-core (>=2.0.0, <=5.7.13)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.0, =0.1.8, =0.1.6, =0.1.7 and more Source cves: CVE-2024-38827 Source advisory: MEND:CVE-2024-38827...

com.erudika:para-jar (>=1.48.0, <=1.49.5), com.erudika:para-server (>=1.48.0, <=1.49.5) +60 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-ldap (>=5.8.0, <=5.8.15)

org.springframework.security:spring-security-ldap MAVEN version =5.8.0, =1.48.0, =1.48.0, =1.48.0, =4.5.0, =11.3.0, =1.18.0, =1.18.0, =1.18.0, =1.18.0, =1.18.0, =1.18.0, =1.18.0, =1.18.0, =1.18.0, =1.18.0, =1.18.9 and more Source cves: CVE-2024-38827 Source advisory: MEND:CVE-2024-38827...

com.arcadeanalytics:arcadeanalytics (>=1.0.2, <=1.0.8), com.github.cobrijani:jwt-security-spring-boot-starter (>=0.0.2, <=0.0.3) +6 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-data (>=4.2.1.release, <=4.2.13.release)

org.springframework.security:spring-security-data MAVEN version =4.2.1.release, =1.0.2, =0.0.2, =1.0.0, =0.0.1, =1.0.0, =1.4.1, =19.0, =20.6 Source cves: CVE-2024-38827 Source advisory: MEND:CVE-2024-38827...

ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +2418 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-core (>=6.3.0, <=6.3.4)

org.springframework.security:spring-security-core MAVEN version =6.3.0, =cloud-0.1, =1.3.0, =1.0.0, =1.0.0, =0.0.1, =1.0.42, =1.0.45 and more Source cves: CVE-2024-38827 Source advisory: MEND:CVE-2024-38827...

cn.herodotus.engine:oauth2-core (>=3.0.1.0, <=3.0.7.0), cn.herodotus.engine:oauth2-sdk-authentication (>=3.0.1.0, <=3.0.7.0) +13 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-cas (>=5.8.1, <=5.8.15)

org.springframework.security:spring-security-cas MAVEN version =5.8.1, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.6.4, =3.0.4.1, =3.0.4.1, =11.3.0, =3.0.7, =5.25.16, =5.25.16, =1.4.0.0.m1, =1.4.0.0 Source cves: CVE-2024-38827 Source advisory: MEND:CVE-2024-38827...

au.csiro.pathling:fhir-server (>=5.3.1, <=6.4.2), au.org.consumerdatastandards:data-holder (>=2.3.0, <=2.4.1) +4095 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-crypto (>=5.7.0, <=5.7.13)

org.springframework.security:spring-security-crypto MAVEN version =5.7.0, =5.3.1, =2.3.0, =6.10.0, =6.4.0, =8.2.2 - cc.chensoul.nacos:core-test 2.5.2 - cc.chensoul.nacos:nacos-address 2.5.2 - cc.chensoul.nacos:nacos-cmdb 2.5.2 - cc.chensoul.nacos:nacos-config 2.5.2 - cc.chensoul.nacos:nacos-conso...

br.jus.stf.digital:core (>=0.2.0, <=2.3.1), br.jus.stf.digital:test (>=1.0.3, <=1.1.0) +1383 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-crypto (>=4.2.0.release, <=4.2.13.release)

org.springframework.security:spring-security-crypto MAVEN version =4.2.0.release, =0.2.0, =1.0.3, =1.0.2, =1.0.2, =1.4.10, =3.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.1.u1 - cn.home1:spring-cloud-service-filter 1.0.1.u1 - cn.spring-up:spring-co 0.1 - cn.spring-up:spring-import 0.1 -...

CVE-2024-38827 Spring Security Authorization Bypass for Case Sensitive Comparisons

The usage of String.toLowerCase and String.toUpperCase has some Locale dependent exceptions that could potentially result in authorization rules not working properly...

au.csiro.pathling:fhir-server (>=5.3.1, <=6.4.2), au.org.consumerdatastandards:data-holder (>=2.3.0, <=2.4.1) +1878 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-config (>=5.7.0, <=5.7.13)

org.springframework.security:spring-security-config MAVEN version =5.7.0, =5.3.1, =2.3.0, =2.4.1 - au.org.consumerdatastandards:mock-data-holder-java 2.6.0 - br.com.m4rc310:br-com-m4rc310-graphql 1.0.1 - br.com.m4rc310:br-com-m4rc310-libs 1.0.1 - br.com.m4rc310:br-com-m4rc310-starter 1.0.1 -...

cc.chensoul.nacos:nacos-distribution (2.5.2), cn.sparrowmini:sparrow-org-service (0.0.1) +738 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-core (>=5.8.0, <=5.8.15)

org.springframework.security:spring-security-core MAVEN version =5.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =5.2.0, =5.11.0, =5.11.0, =1.48.0, =1.48.0, =1.48.0, =2.4.0, =2.4.0, =2.6.0 and more Source cves: CVE-2024-38827 Source advisory: MEND:CVE-2024-38827...

cn.herodotus.engine:oauth2-core (>=2.7.0.0, <=3.0.0-m2), cn.herodotus.engine:oauth2-sdk-authentication (>=2.7.7.3, <=2.7.18.final) +377 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-cas (>=5.7.1, <=5.7.11)

org.springframework.security:spring-security-cas MAVEN version =5.7.1, =2.7.0.0, =2.7.7.3, =2.7.7.4, =2.7.0.0, =2.7.0.0, =2.7.1.2, =2.7.0.0, =2.7.2.3, =2.7.0.0, =2.7.x.20240823.release, =2.7.x.20241003.release - com.github.zengfr.platform:oauth2-core 2.7.2.6 -...