CVE-2024-38829CWE-178

Spring LDAP sensitive data exposure for case-sensitive comparisons

Low · published December 4, 2024

CVSS v3.1
3.7
EPSS
0%
Percentile
29.5
In the wild
Unconfirmed
What it is

A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried

Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00368 · 29.5th percentile
Weakness
CWE-178 · Improper Handling of Case Sensitivity
Published
2024-12-04T21:06Z
EPSS history
Timeline
  • 04 DEC 21:06Z
    Spring LDAP sensitive data exposure for case-sensitive comparisons
    cvelistv5