Spring LDAP sensitive data exposure for case-sensitive comparisons (Spring Spring LDAP)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.37 % · percentile 31 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- vmware
- NVD status
- Deferred
Description
A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820
Weaknesses (CWE)
- CWE-178 — Improper Handling of Case Sensitivity
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | LOW 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | vmware |
| CVSS 3.1 | LOW 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · security@vmware.com (Secondary) |
Advisories
- GHSA-mqvr-2rp8-j7h4 — Spring LDAP data exposure vulnerability
European references
- ENISA EUVD · EUVD-2024-3490
- GCVE · GCVE-0-2024-38829
CERT-FR advisories
- CERTFR-2025-AVI-0969 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1005 — Multiples vulnérabilités dans les produits Spring · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Spring · Spring LDAP | affected 2.4.0 ≤ 2.4.3 ; affected 3.0.0 ≤ 3.0.9 ; affected 3.1.0 ≤ 3.1.7 ; affected 3.2.0 ≤ 3.2.7 ; affected 0 ≤ 2.4.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |