Spring Framework has Authorization Bypass for Case Sensitive Comparisons
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-38827US | — | — | ||
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc9WEB
- https://github.com/spring-projects/spring-framework/issues/33708WEB
- https://github.com/spring-projects/spring-framework/issues/34232WEB
- https://github.com/spring-projects/spring-securityPACKAGE
- https://nvd.nist.gov/vuln/detail/CVE-2024-38827ADVISORY
- https://security.netapp.com/advisory/ntap-20250124-0007WEB
- https://spring.io/security/cve-2024-38827WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan