CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception
Priority LOW 25CWE-178Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00617 49th percentileScored 2026-11-07
Fix Fixed Spring (VMware): 5.3.41, 6.0.25, 6.1.14org.springframework:spring-context (Maven): 6.1.14+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Spring | 5.3.x to before 5.3.41; 6.0.x to before 6.0.25; 6.1.x to before 6.1.14 | 5.3.41, 6.0.25, 6.1.14 | Patch available | CNA |
| — | org.springframework:spring-context (Maven) | 6.1.0 to before 6.1.14 | 6.1.14 | Patch available | GHSA-4gc7-5j7h-4qph |
| — | org.springframework:spring-web (Maven) | 6.1.0 to before 6.1.14 | 6.1.14 | Patch available | GHSA-4gc7-5j7h-4qph |
| — | org.springframework:spring-web (Maven) | 6.0.0 – 6.0.24 | — | No fix listed | GHSA-4gc7-5j7h-4qph |
| — | org.springframework:spring-context (Maven) | 6.0.0 – 6.0.24 | — | No fix listed | GHSA-4gc7-5j7h-4qph |
| — | org.springframework:spring-context (Maven) | up to 5.3.40 | — | No fix listed | GHSA-4gc7-5j7h-4qph |
| — | org.springframework:spring-web (Maven) | up to 5.3.40 | — | No fix listed | GHSA-4gc7-5j7h-4qph |
- Spring VendorVMware Affected 5.3.x to before 5.3.41; 6.0.x to before 6.0.25; 6.1.x to before 6.1.14 Fixed in 5.3.41, 6.0.25, 6.1.14 Patch available CNA
- org.springframework:spring-context (Maven) Vendor— Affected 6.1.0 to before 6.1.14 Fixed in 6.1.14 Patch available GHSA-4gc7-5j7h-4qph
- org.springframework:spring-web (Maven) Vendor— Affected 6.1.0 to before 6.1.14 Fixed in 6.1.14 Patch available GHSA-4gc7-5j7h-4qph
- org.springframework:spring-web (Maven) Vendor— Affected 6.0.0 – 6.0.24 Fixed in — No fix listed GHSA-4gc7-5j7h-4qph
- org.springframework:spring-context (Maven) Vendor— Affected 6.0.0 – 6.0.24 Fixed in — No fix listed GHSA-4gc7-5j7h-4qph
- org.springframework:spring-context (Maven) Vendor— Affected up to 5.3.40 Fixed in — No fix listed GHSA-4gc7-5j7h-4qph
- org.springframework:spring-web (Maven) Vendor— Affected up to 5.3.40 Fixed in — No fix listed GHSA-4gc7-5j7h-4qph
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* | 5.3.0 to before 5.3.41; 6.0.0 to before 6.0.25; 6.1.0 to before 6.1.14 | Vulnerable | VMware |
- cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions 5.3.0 to before 5.3.41; 6.0.0 to before 6.0.25; 6.1.0 to before 6.1.14 Vulnerable ·VMware
Remediation
- Fix · CNA Spring (VMware) Fixed in 5.3.41, 6.0.25, 6.1.14
- Fix · GHSA-4gc7-5j7h-4qph org.springframework:spring-context (Maven) Fixed in 6.1.14 Advisory →
- Fix · GHSA-4gc7-5j7h-4qph org.springframework:spring-web (Maven) Fixed in 6.1.14 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-38820
- 2026-10-03 Alias added: GHSA-4gc7-5j7h-4qph
References
More VMware Spring Framework vulnerabilities
- TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
- TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
- TI-2020-04444 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application CVSS 3.1HIGH 7.5
- TI-2018-01180 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
- TI-2016-09283 Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution… CVSS 3.1CRITICAL 9.8
- TI-2014-00050 The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8… CVSS 2.0MEDIUM 6.8
Sources
- CVE-2024-38820 · CVE Program
- CVE-2024-38820 · NVD
- FIRST EPSS
- GHSA-4gc7-5j7h-4qph · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences