CVE-2024-38820

CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception

Low · published October 18, 2024

CVSS v3.1
3.1
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00617 · 48.9th percentile
Published
2024-10-18T05:39Z
EPSS history
Timeline
  • 18 OCT 05:39Z
    CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception
    cvelistv5