Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-38809
CVE-2024-38809:
Java vulnerability analysis and mitigation
Overview
CVE-2024-38809 is a vulnerability in the Spring Framework that affects versions 6.1.0-6.1.11, 6.0.0-6.0.22, and 5.3.0-5.3.37, as well as older unsupported versions. The vulnerability was discovered by Seokchan Yoon and publicly disclosed on August 14, 2024. It affects applications that parse ETags from 'If-Match' or 'If-None-Match' request headers, making them vulnerable to Denial of Service (DoS) attacks (Spring Security, NVD).
Technical details
The vulnerability is classified as MEDIUM severity with a CVSS v3.1 base score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). It is categorized under CWE-400 (Uncontrolled Resource Consumption). The issue stems from improper ETag prefix validation when processing 'If-Match' or 'If-None-Match' request headers, which can lead to resource exhaustion (NVD).
Impact
When successfully exploited, this vulnerability can result in Denial of Service (DoS) conditions, affecting the availability of the application. The attack vector is network-accessible and requires no authentication or user interaction to exploit (Spring Security, NetApp Security).
Mitigation and workarounds
Users of affected versions should upgrade to the corresponding fixed versions: 6.1.12, 6.0.23, or 5.3.38. For users of older, unsupported versions, it is recommended to enforce a size limit on 'If-Match' and 'If-None-Match' headers through a Filter. Commercial customers using Spring Boot 2.7, 3.0, or 3.1 can utilize Spring Boot Hotfix releases 2.7.21.1, 3.0.16.1, and 3.1.12.1 (Spring Blog).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management