CVE-2024-38820
published 2025-05-16CVE-2024-38820: CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However…
PriorityP424medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.63%
46.2th percentile
CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks. Affected Spring Products and Versions Spring Framework: * 6.2.0 - 6.2.6 * 6.1.0 - 6.1.19 * 6.0.0 - 6.0.27 * 5.3.0 - 5.3.42 * Older, unsupported versions are also affected Mitigation Users of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix Version Availability 6.2.x 6.2.7 OSS6.1.x 6.1.20 OSS6.0.x 6.0.28 Commercial https://enterprise.spring.io/ 5.3.x 5.3.43 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. Generally, we recommend using a dedicated model object with properties only for data binding, or using constructor binding since constructor arguments explicitly declare what to bind together with turning off setter binding through the declarativeBinding flag. See the Model Design section in the reference documentation. For setting binding, prefer the use of allowedFields (an explicit list) over disallowedFields. Credit This issue was responsibly reported by the TERASOLUNA Framework Development Team from NTT DATA Group Corporation.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libspring-java | — | — |
| spring | spring_framework | 5.3.0 – 5.3.42 | — |
| spring | spring_framework | 6.0.0 – 6.0.27 | — |
| spring | spring_framework | 6.1.0 – 6.1.19 | — |
| spring | spring_framework | 6.2.0 – 6.2.6 | — |
| vmware | spring_framework | >= 5.3.0 < 5.3.41 | 5.3.41 |
| vmware | spring_framework | >= 6.0.0 < 6.0.25 | 6.0.25 |
| vmware | spring_framework | >= 6.1.0 < 6.1.14 | 6.1.14 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
ghsa5.3MEDIUM
osv5.3MEDIUM
vendor_debian5.3LOW
vendor_oracle5.3LOW
vendor_redhat3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (Spring Framework) — CVE-2024-38820
vendor_oracle·2025-04-15·CVSS 5.3
CVE-2024-38820 [LOW] Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (Spring Framework) — CVE-2024-38820
Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (Spring Framework) vulnerability
CVE: CVE-2024-38820
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2025 (APR 2025)
Debian
CVE-2025-22233: libspring-java - CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the con...
vendor_debian·2025·CVSS 3.1
CVE-2025-22233 [LOW] CVE-2025-22233: libspring-java - CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the con...
CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks. Affected Spring Products and Versions Spring Framework: * 6.2.0 - 6.2.6 * 6.1.0 - 6.1.19 * 6.0.0 - 6.0.27 * 5.3.0 - 5.3.42 * Older, unsupported versions are also affected Mitigation Users of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix Version Availability 6.2.x 6.2.7 OSS6.1.x 6.1.20 OSS6.0.x 6.0.28 Commercial https://enterprise.spring.io/ 5.3.x 5.3.43 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. Generally, we recommend using a dedicated model object with properties only
Red Hat
spring-ldap: Spring LDAP sensitive data exposure for case-sensitive comparisons
vendor_redhat·2024-12-04·CVSS 3.1
CVE-2024-38829 [LOW] CWE-178 spring-ldap: Spring LDAP sensitive data exposure for case-sensitive comparisons
spring-ldap: Spring LDAP sensitive data exposure for case-sensitive comparisons
A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried
Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820
A flaw was found in Spring LDAP. The usage of String.toLowerCase() and String.toUpperCase() has some locale dependent exceptions that could result in unintended columns being queried.
Package: org.springframework.ldap/spring-ldap-
Debian
CVE-2024-38820: libspring-java - The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case ins...
vendor_debian·2024·CVSS 5.3
CVE-2024-38820 [MEDIUM] CVE-2024-38820: libspring-java - The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case ins...
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
Debian
CVE-2024-38829: libspring-java - A vulnerability in Spring LDAP allows data exposure for case sensitive compariso...
vendor_debian·2024·CVSS 3.1
CVE-2024-38829 [LOW] CVE-2024-38829: libspring-java - A vulnerability in Spring LDAP allows data exposure for case sensitive compariso...
A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
GHSA
Spring Framework DataBinder Case Sensitive Match Exception
ghsa·2025-05-16·CVSS 5.3
CVE-2025-22233 [MEDIUM] CWE-20 Spring Framework DataBinder Case Sensitive Match Exception
Spring Framework DataBinder Case Sensitive Match Exception
CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks.
Affected Spring Products and Versions
Spring Framework:
* 6.2.0 - 6.2.6
* 6.1.0 - 6.1.19
* 6.0.0 - 6.0.27
* 5.3.0 - 5.3.42
* Older, unsupported versions are also affected
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix Version | Availability |
| - | - | - |
| 6.2.x | 6.2.7 | OSS |
| 6.1.x | 6.1.20 | OSS |
| 6.0.x | 6.0.28 | Commercial https://enterprise.spring.io/ |
| 5.3.x | 5.3.43 | Commercial https://enterprise.spring
OSV
CVE-2025-22233: CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names
osv·2025-05-16·CVSS 5.3
CVE-2025-22233 [MEDIUM] CVE-2025-22233: CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names
CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks. Affected Spring Products and Versions Spring Framework: * 6.2.0 - 6.2.6 * 6.1.0 - 6.1.19 * 6.0.0 - 6.0.27 * 5.3.0 - 5.3.42 * Older, unsupported versions are also affected Mitigation Users of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix Version Availability 6.2.x 6.2.7 OSS6.1.x 6.1.20 OSS6.0.x 6.0.28 Commercial https://enterprise.spring.io/ 5.3.x 5.3.43 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. Generally, we recommend using a dedicated model object with properties only
OSV
Spring Framework DataBinder Case Sensitive Match Exception
osv·2025-05-16·CVSS 5.3
CVE-2025-22233 [MEDIUM] Spring Framework DataBinder Case Sensitive Match Exception
Spring Framework DataBinder Case Sensitive Match Exception
CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks.
Affected Spring Products and Versions
Spring Framework:
* 6.2.0 - 6.2.6
* 6.1.0 - 6.1.19
* 6.0.0 - 6.0.27
* 5.3.0 - 5.3.42
* Older, unsupported versions are also affected
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix Version | Availability |
| - | - | - |
| 6.2.x | 6.2.7 | OSS |
| 6.1.x | 6.1.20 | OSS |
| 6.0.x | 6.0.28 | Commercial https://enterprise.spring.io/ |
| 5.3.x | 5.3.43 | Commercial https://enterprise.spring
GHSA
Spring LDAP data exposure vulnerability
ghsa·2024-12-04·CVSS 5.3
CVE-2024-38829 [MEDIUM] CWE-178 Spring LDAP data exposure vulnerability
Spring LDAP data exposure vulnerability
A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried
Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820
OSV
CVE-2024-38829: A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons
osv·2024-12-04·CVSS 5.3
CVE-2024-38829 [MEDIUM] CVE-2024-38829: A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons
A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820
OSV
Spring LDAP data exposure vulnerability
osv·2024-12-04·CVSS 5.3
CVE-2024-38829 [MEDIUM] Spring LDAP data exposure vulnerability
Spring LDAP data exposure vulnerability
A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried
Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820
OSV
Spring Framework DataBinder Case Sensitive Match Exception
osv·2024-10-18·CVSS 5.3
CVE-2024-38820 [MEDIUM] Spring Framework DataBinder Case Sensitive Match Exception
Spring Framework DataBinder Case Sensitive Match Exception
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
GHSA
Spring Framework DataBinder Case Sensitive Match Exception
ghsa·2024-10-18·CVSS 5.3
CVE-2024-38820 [MEDIUM] CWE-178 Spring Framework DataBinder Case Sensitive Match Exception
Spring Framework DataBinder Case Sensitive Match Exception
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
OSV
CVE-2024-38820: The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive
osv·2024-10-18·CVSS 5.3
CVE-2024-38820 [MEDIUM] CVE-2024-38820: The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
No detection rules found.
No public exploits indexed.
2025-05-16
Published