CVE-2024-38808

mediumpriority · track · 0EPSS 0.006 · 47 %ileDEEUFRRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.57% (47th) EPSS

CVSS 4.3 · medium

Is it mine?

35 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.

cvss

Technical severity, 0–10. One row per scoring source.

4.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.3mediumAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:Lsecondary · FSTEC (BDU) RU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:Lsecondary · ENISA EU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:Lsecondary · security@vmware.comexploitability 2.8 · impact 1.4

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:Lsecondary · OSV

v3.14mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-404USCWE-770USCWE-770US

affected products (35)

Products and version ranges known to be affected.

Hitachi Ops Centerall versionscert_bundDEcpe:/a:hitachi:ops_center:-
IBM Business Automation Workflowall versionscert_bundDEcpe:/a:ibm:business_automation_workflow:-
IBM Business Automation Workflow <21.0.3-IF039all versionscert_bundDE
IBM Business Automation Workflow <24.0.0-IF004all versionscert_bundDE
IBM InfoSphere Information Server 11.7all versionscert_bundDEcpe:/a:ibm:infosphere_information_server:11.7
IBM Operational Decision Manager 8.11.xall versionscert_bundDEcpe:/a:ibm:operational_decision_manager:8.11.x
IBM Operational Decision Manager 8.12.xall versionscert_bundDEcpe:/a:ibm:operational_decision_manager:8.12.x
IBM Operational Decision Manager 9.0.0all versionscert_bundDEcpe:/a:ibm:operational_decision_manager:9.0.0
IBM QRadar SIEM <7.5.0 UP10 IF01all versionscert_bundDE
IBM Rational ClearCaseall versionscert_bundDEcpe:/a:ibm:rational_clearcase:-
IBM SPSS Collaboration and Deployment Servicesall versionscert_bundDEcpe:/a:ibm:spss:collaboration_and_deployment_services
IBM Security Guardium 12.0all versionscert_bundDEcpe:/a:ibm:security_guardium:12.0
NetApp ActiveIQ Unified Managerall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SolarWinds Security Event Manager <2025.4all versionscert_bundDE
Trellix ePolicy Orchestrator <5.10.0 Service pack 1 Update 5all versionscert_bundDE
VMware Tanzu Spring Framework <5.3.38all versionscert_bundDE
VMware Tanzu Spring Framework <5.3.39all versionscert_bundDE
IBM Business Automation Workflow< 21.0.3-IF039cert_bundDE
IBM Business Automation Workflow< 24.0.0-IF004cert_bundDE

showing 20 of 35

advisories (4)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-1853VMware Tanzu Spring Framework: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2024-08-14csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Framework ausnutzen, um einen Denial of Service Angriff durchzuführen.
WID-SEC-W-2024-3221Oracle Retail Applications: Mehrere SchwachstellenDeutsch2024-10-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Retail Applications ausnutzen, um die Integrität und Verfügbarkeit zu gefährden.
GHSA-9cmq-m9j5-mvwwSpring Framework vulnerable to Denial of Service2024-08-20ghsa · osvUS
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Older, unsupported versions are also affected. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.
CERTFR-2026-AVI-1336Multiples vulnérabilités dans les produits IBMFrançais2026-10-16vendor · certfrFR

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund osv certfr NVD CVE.org MITRE

published 2024-08-20modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan