Vulnerability

CVE-2024-38820

 Report advisory or correction

CVSS Score 5.3 medium

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-178

References

https://spring.io/security/cve-2024-38820
https://github.com/advisories/GHSA-4gc7-5j7h-4qph
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-38820

[CVE-2024-38820] CWE-178: Improper Handling of Case Sensitivity

Description

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

See org.springframework/spring-context package information