CVE-2024-38829

Spring LDAP sensitive data exposure for case-sensitive comparisons

State: Published
Severity: 3.7 Low
Published: Dec 4, 2024
Updated: Dec 10, 2024
Reserved: Jun 19, 2024

Description

A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820

Scores

CVSS	Score	Vector	Source
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	vmware

Weaknesses

CWE-178

Affected Products

Product	Versions
Spring LDAPSpring	2.4.0 through 2.4.3Affected 3.0.0 through 3.0.9Affected 3.1.0 through 3.1.7Affected 3.2.0 through 3.2.7Affected 2.4.0 and earlierAffected

References

https://spring.io/security/cve-2024-38829vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.