Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2024-38827

Spring Security Authorization Bypass for Case Sensitive Comparisons

Description

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring by VMware Tanzu Spring Security

Default version status: unaffected

  • 5.7.0 - 5.7.13, 5.8.0 - 5.8.15, 6.0.0 - 6.0.13, 6.1.0 - 6.1.11, 6.2.0 - 6.2.7, 6.3.0 - 6.3.4, Older unsupported versions are also affectedaffected

References