Fluid Attacks Database

Description

Spring Framework has Authorization Bypass for Case Sensitive Comparisons The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
maven	org.springframework:spring-jdbc	<0	6.1.14
maven	org.springframework:spring-expression	<0	6.1.14
maven	org.springframework:spring-context	<0	6.1.14
maven	org.springframework:spring-beans	<0	6.1.14
maven	org.springframework.security:spring-security-core	>=0 <5.7.14 \|\| >=5.8.0 <5.8.16 \|\| >=6.0.0 <6.0.14 \|\| >=6.1.0 <6.1.12 \|\| >=6.2.0 <6.2.8 \|\| >=6.3.0 <6.3.5	5.7.14, 5.8.16, 6.0.14, 6.1.12, 6.2.8, 6.3.5
maven	org.springframework:spring-core	<0	6.1.14

Aliases

1. CVE-2024-388272. NVD-2024-388273. OSV-2024-388274. GHSA-q3v6-hm2v-pw995. GCVE-2024-388276. SPRING-cve-2024-38827

References

1. https://github.com/spring-projects/spring-framework/issues/337082. https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc93. https://github.com/spring-projects/spring-framework4. https://github.com/spring-projects/spring-framework/issues/342325. https://security.netapp.com/advisory/ntap-20250124-00076. https://spring.io/security/cve-2024-38827

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.