Skip to content
Sign in
3.1 Low

CVE-2024-38820 The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive

Description

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

Affected products and versions

Product Affected versions Fixed in
Spring 6.1 6.1.x → < 6.1.14 6.1.14
Spring 6.0 6.0.x → < 6.0.25 6.0.25
Spring 5.3 5.3.x → < 5.3.41 5.3.41

Other CVEs of Spring

The 2 CVEs of Spring →
CVE-2024-38828 Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack 5.3 Medium
Track this CVE