Spring Framework has Authorization Bypass for Case Sensitive Comparisons
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-38827US | — | — | ||
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc9WEB
- https://github.com/spring-projects/spring-framework/issues/33708WEB
- https://github.com/spring-projects/spring-framework/issues/34232WEB
- https://github.com/spring-projects/spring-securityPACKAGE
- https://nvd.nist.gov/vuln/detail/CVE-2024-38827ADVISORY
- https://security.netapp.com/advisory/ntap-20250124-0007WEB
- https://spring.io/security/cve-2024-38827WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan