CVSS 3.1
3.7 lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2024-38829
Low (3.7). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in org.springframework.ldap:spring-ldap-core 2.4.4, 3.2.8.
A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried
Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
- CWE
- CWE-178
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mqvr-2rp8-j7h4 | Maven | org.springframework.ldap:spring-ldap-core | >=3.0.0 <3.2.8 | 3.2.8 |
| GHSA-mqvr-2rp8-j7h4 | Maven | org.springframework.ldap:spring-ldap-core | <2.4.4 | 2.4.4 |