CVE-2024-38820 — CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception

CVE-2024-38820

CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception PUBLISHED

Description (CNA)

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

Affected (CNA)

Vendor / product	Versions
VMware / Spring	affected 5.3.x before 5.3.41; affected 6.0.x before 6.0.25; affected 6.1.x before 6.1.14

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2024-38820

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://security.netapp.com/advisory/ntap-20241129-0003/