Skip to content
Sign in
9.1 Critical

CVE-2024-38821 Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under…

Description

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: * It must be a WebFlux application * It must be using Spring's static resources support * It must have a non-permitAll authorization rule applied to the static resources support

Affected products and versions

Product Affected versions Fixed in
Spring 6.3 6.3.x → < 6.3.4 6.3.4
Spring 6.2 6.2.x → < 6.2.7 6.2.7
Spring 6.1 6.1.x → < 6.1.11 6.1.11
Spring 6.0 6.0.x → < 6.0.13 6.0.13
Spring 5.8 5.8.x → < 5.8.15 5.8.15
Spring 5.7 5.7.x → < 5.7.13 5.7.13
webflux 6.3 6.3x → < 6.3.4 6.3.4
webflux 6.2 6.2x → < 6.2.7 6.2.7
webflux 6.1 6.1x → < 6.1.11 6.1.11
Show the 3 other branches
Product Affected versions Fixed in
webflux 6.0 6.0x → < 6.0.13 6.0.13
webflux 5.8 5.8x → < 5.8.15 5.8.15
webflux 5.7 5.7.x → < 5.7.13 5.7.13

Other CVEs of Spring

The 4 CVEs of Spring →
CVE-2024-38828 Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack 5.3 Medium CVE-2024-38816 Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to… 7.5 High CVE-2024-22258 Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are… 6.1 Medium
Track this CVE