CVE-2024-38807
CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader
MEDIUM 6.3
At a glance
- Source
- NVD
- EPSS
- EPSS 0.12 % · percentile 2 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- vmware
- NVD status
- Deferred
Description
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.
Weaknesses (CWE)
- CWE-347 — Improper Verification of Cryptographic Signature
- CWE-290 — Authentication Bypass by Spoofing
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N | vmware |
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N | NVD · security@vmware.com (Secondary) |
Advisories
- GHSA-7cj3-x93g-gj76 — Signature forgery in Spring Boot's Loader
European references
- ENISA EUVD · EUVD-2024-2526
- GCVE · GCVE-0-2024-38807
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0322 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0969 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0715 — Vulnérabilité dans Spring Boot · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Spring · Spring Boot | affected 2.7.x < 2.7.22 ; affected 3.0.x < 3.0.17 ; affected 3.1.x < 3.1.13 ; affected 3.2.x < 3.2.9 ; affected 3.3.x < 3.3.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |