CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
Other sources
VMware Tanzu Spring Framework could provide weaker than expected security, caused by a flaw related to disallowedFields patterns in DataBinder is case insensitive. A remote attacker could exploit this vulnerability to launch further attacks on the system.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38820?
CVE-2024-38820 has a moderate severity rating due to potential issues with case sensitivity in field protection.
How do I fix CVE-2024-38820?
To resolve CVE-2024-38820, upgrade to Spring Framework versions 6.1.14 or later, or ensure you are using a version outside the affected ranges.
What software is affected by CVE-2024-38820?
CVE-2024-38820 affects Spring Framework versions 5.3.0 to 5.3.41, 6.0.0 to 6.0.25, and 6.1.0 to 6.1.14.
What are the potential risks of CVE-2024-38820?
The risks associated with CVE-2024-38820 include unauthorized access to fields that should be protected due to incorrect case sensitivity handling.
Is there a workaround for CVE-2024-38820?
No official workaround is recommended for CVE-2024-38820 other than upgrading to a secure version of the Spring Framework.