Spring LDAP sensitive data exposure for case-sensitive comparisons (Spring Spring LDAP)
En bref
- Source
- NVD
- EPSS
- EPSS 0.37 % · centile 31 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- vmware
- Statut NVD
- Deferred
Description
A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820
Faiblesses (CWE)
- CWE-178 — Gestion incorrecte de la casse
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | LOW 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | vmware |
| CVSS 3.1 | LOW 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · security@vmware.com (Secondary) |
Avis
- GHSA-mqvr-2rp8-j7h4 — Spring LDAP data exposure vulnerability
Références européennes
- ENISA EUVD · EUVD-2024-3490
- GCVE · GCVE-0-2024-38829
Avis du CERT-FR
- CERTFR-2025-AVI-0969 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1005 — Multiples vulnérabilités dans les produits Spring · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Spring · Spring LDAP | affected 2.4.0 ≤ 2.4.3 ; affected 3.0.0 ≤ 3.0.9 ; affected 3.1.0 ≤ 3.1.7 ; affected 3.2.0 ≤ 3.2.7 ; affected 0 ≤ 2.4.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |