GitHub Advisoryadvisory · Maven

GHSA-mqvr-2rp8-j7h4 Spring LDAP data exposure vulnerability

MEDIUM Published 2024-12-04 Modified 2024-12-10 Official page ↗
Aliases
CVE-2024-38829
Ecosystem
Maven
Packages
org.springframework.ldap:spring-ldap-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-178
Reviewed
2024-12-04

Affected packages

• Maven org.springframework.ldap:spring-ldap-core: >= 3.0.0, < 3.2.8 → fixed in 3.2.8 • Maven org.springframework.ldap:spring-ldap-core: < 2.4.4 → fixed in 2.4.4

Description

A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820

Related

Alias · CVE (1)

  • CVE-2024-38829 A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through… vulnerability

Weakness · CWE (1)

  • CWE-178 Improper Handling of Case Sensitivity weakness

References