CVE-2024-38827CWE-639

Spring Security Authorization Bypass for Case Sensitive Comparisons

Medium · published December 2, 2024

CVSS v3.1
4.8
EPSS
0%
Percentile
30.4
In the wild
Unconfirmed
What it is

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00377 · 30.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2024-12-02T14:32Z
EPSS history
Timeline
  • 02 DEC 14:32Z
    Spring Security Authorization Bypass for Case Sensitive Comparisons
    cvelistv5