Home

Description

A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820

PUBLISHED Reserved 2024-06-19 | Published 2024-12-04 | Updated 2024-12-10 | Assigner vmware




LOW: 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-178

Product status

Default status
unaffected

2.4.0 (Spring LDAP)
affected

3.0.0 (Spring LDAP)
affected

3.1.0 (Spring LDAP)
affected

3.2.0 (Spring LDAP)
affected

Any version
affected

References

spring.io/security/cve-2024-38829 vendor-advisory

cve.org (CVE-2024-38829)

nvd.nist.gov (CVE-2024-38829)

Download JSON