Riskcovery

CVE-2024-38821

Authorization Bypass of Static Resources in WebFlux Applications

State
Published
Severity
9.1 Critical
Published
Oct 28, 2024
Updated
Jan 24, 2025
Reserved
Jun 19, 2024

Read the record on cve.org

Description

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.

For this to impact an application, all of the following must be true:

* It must be a WebFlux application * It must be using Spring's static resources support * It must have a non-permitAll authorization rule applied to the static resources support

Scores

CVSSScoreVectorSource
3.19.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nvmware

Weaknesses

  • CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

ProductVersions
SpringSpring
  • 5.7.x to before 5.7.13Affected
  • 5.8.x to before 5.8.15Affected
  • 6.0.x to before 6.0.13Affected
  • 6.1.x to before 6.1.11Affected
  • 6.2.x to before 6.2.7Affected
  • 6.3.x to before 6.3.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.