Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-38820
CVE-2024-38820:
Java vulnerability analysis and mitigation
Overview
CVE-2024-38820 is a vulnerability in the Spring Framework's DataBinder functionality, discovered and reported by Marek Parfianowicz, Principal Engineer at Atlassian. The vulnerability affects Spring Framework versions 5.3.0-5.3.40, 6.0.0-6.0.24, and 6.1.0-6.1.13. The issue stems from a fix implemented for a previous vulnerability (CVE-2022-22968) that made disallowedFields patterns in DataBinder case insensitive (Spring Security).
Technical details
The vulnerability arises from the use of String.toLowerCase() in the DataBinder's case-insensitive implementation, which has locale-dependent exceptions that could potentially result in fields not being protected as expected. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N by NIST, while VMware assessed it with a lower score of 3.1 (LOW) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N (NVD).
Impact
When successfully exploited, this vulnerability could lead to addition or modification of data in affected systems. The primary impact is related to fields not being properly protected due to case sensitivity issues in the DataBinder implementation (NetApp Advisory).
Mitigation and workarounds
Users of affected versions should upgrade to the corresponding fixed versions: 5.3.41 for 5.3.x users, 6.0.25 for 6.0.x users, and 6.1.14 for 6.1.x users. Commercial customers using Spring Boot 2.7, 3.0, or 3.1 can utilize Spring Boot Hotfix releases 2.7.22.2, 3.0.17.2, and 3.1.13.2 (Spring Blog).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management