CVE-2024-38829

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-178

Affected software

No affected versions have been published.

Timeline

Published: Dec 4, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-38835.4The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Bookmark URL field in all versions up to, and incl CVE-2024-388307.8VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigg CVE-2024-388317.8VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can inse CVE-2024-388326.4VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to i CVE-2024-388335.4VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might CVE-2024-388344.8VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might b CVE-2024-38847.5A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(Str CVE-2024-38855.4The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the subcontainer value parameter in a CVE-2024-388569.8Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade CVE-2024-388576.1Improper neutralization of input in Checkmk before versions 2.3.0p8, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows attackers to craft malicious CVE-2024-388586.1Improper neutralization of input in Checkmk before version 2.3.0p14 allows attackers to inject and run malicious scripts in the Robotmk logs CVE-2024-388596.1XSS in the view page with the SLA column configured in Checkmk versions prior to 2.3.0p14, 2.2.0p33, 2.1.0p47 and 2.0.0 (EOL) allowed malici