GitHub Advisoryadvisory · Maven

GHSA-q3v6-hm2v-pw99 Spring Framework has Authorization Bypass for Case Sensitive Comparisons

MEDIUM Published 2024-12-02 Modified 2025-01-24 Official page ↗
Aliases
CVE-2024-38827
Ecosystem
Maven
Packages
org.springframework.security:spring-security-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-639
Reviewed
2024-12-02

Affected packages

• Maven org.springframework.security:spring-security-core: < 5.7.14 → fixed in 5.7.14 • Maven org.springframework.security:spring-security-core: >= 5.8.0, < 5.8.16 → fixed in 5.8.16 • Maven org.springframework.security:spring-security-core: >= 6.0.0, < 6.0.14 → fixed in 6.0.14 • Maven org.springframework.security:spring-security-core: >= 6.1.0, < 6.1.12 → fixed in 6.1.12 • Maven org.springframework.security:spring-security-core: >= 6.2.0, < 6.2.8 → fixed in 6.2.8 • Maven org.springframework.security:spring-security-core: >= 6.3.0, < 6.3.5 → fixed in 6.3.5

Description

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Related

Alias · CVE (1)

  • CVE-2024-38827 The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in… vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References