Data Exposure Via Case Sensitive Comparisons in VMware Tanzu Spring LDAP
CVE-2024-38829

3.7LOW

Key Information:

Vendor

Spring

Status
Spring Ldap
Vendor
CVE Published:
4 December 2024

What is CVE-2024-38829?

A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820

Affected Version(s)

Spring LDAP 2.4.0 <= 2.4.3

Spring LDAP 3.0.0 <= 3.0.9

Spring LDAP 3.1.0 <= 3.1.7

References

https://spring.io/security/cve-2024-38829
vendor-advisory

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.