CVE-2024-38827 — Spring Security Authorization Bypass for Case Sensitive Comparisons

CVE-2024-38827

Spring Security Authorization Bypass for Case Sensitive Comparisons PUBLISHED

Description (CNA)

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Affected (CNA)

Vendor / product	Versions
Spring by VMware Tanzu / Spring Security	affected 5.7.0 - 5.7.13, 5.8.0 - 5.8.15, 6.0.0 - 6.0.13, 6.1.0 - 6.1.11, 6.2.0 - 6.2.7, 6.3.0 - 6.3.4, Older unsupported versions are also affected

CWE

CWE-639

References

https://spring.io/security/cve-2024-38827

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://security.netapp.com/advisory/ntap-20250124-0007/