medium4.8
CVE-2024-38827
Spring Framework has Authorization Bypass for Case Sensitive Comparisons
Impact
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.security:spring-security-core | < 5.7.14 | 5.7.14 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://spring.io/security/cve-2024-38827
- https://security.netapp.com/advisory/ntap-20250124-0007/
- https://github.com/advisories/GHSA-q3v6-hm2v-pw99
- https://nvd.nist.gov/vuln/detail/CVE-2024-38827
- https://github.com/spring-projects/spring-framework/issues/33708
- https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc9
- https://github.com/spring-projects/spring-framework/issues/34232
- https://security.netapp.com/advisory/ntap-20250124-0007