CVE-2024-38820

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-178

Affected software

Vendor	Product	Versions
VMware	Spring	>= 5.3.x, < 5.3.41; >= 6.0.x, < 6.0.25; >= 6.1.x, < 6.1.14

References

Timeline

Published: Oct 18, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-388219.1Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. CVE-2024-388222.7Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.CVE-2024-388232.7Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.CVE-2024-388247.5Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.CVE-2024-388256.4The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated again CVE-2024-388265.3Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of CVE-2024-388274.8The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorizati CVE-2024-388285.3Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.CVE-2024-388293.7A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3,CVE-2024-38835.4The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Bookmark URL field in all versions up to, and incl CVE-2024-388307.8VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigg CVE-2024-388317.8VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can inse