Spring Boot Loader Vulnerability: Signature Forgery Attack
CVE-2024-38807

6.3MEDIUM

Key Information:

Vendor

Spring

Status
Spring Boot
Vendor
CVE Published:
23 August 2024

What is CVE-2024-38807?

Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.

Affected Version(s)

Spring Boot 2.7.x < 2.7.22

Spring Boot 3.0.x < 3.0.17

Spring Boot 3.1.x < 3.1.13

References

https://spring.io/security/cve-2024-38807

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-38807 : Spring Boot Loader Vulnerability: Signature Forgery Attack