Aller au contenu
Se connecter
3.1 Faible

CVE-2024-38820 The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive

Description

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

Produits et versions touchés

Produit Versions touchées Corrigé en
Spring 6.1 6.1.x → < 6.1.14 6.1.14
Spring 6.0 6.0.x → < 6.0.25 6.0.25
Spring 5.3 5.3.x → < 5.3.41 5.3.41

Autres CVE de Spring

Les 2 CVE de Spring →
CVE-2024-38828 Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack 5.3 Moyenne
Suivre cette CVE