CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LCVE-2024-38808
Medium (4.3). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in org.springframework:spring-expression 5.3.39.
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.
Specifically, an application is vulnerable when the following is true:
* The application evaluates user-supplied SpEL expressions.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
- CWE
- CWE-770
- Published
- Modified
- Record from
- the NVD, synced
Affected
- netapp:active_iq_unified_manager
- netapp:oncommand_insight
- vmware:spring_framework
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9cmq-m9j5-mvww | Maven | org.springframework:spring-expression | <5.3.39 | 5.3.39 |