{"id":"CVE-2024-38827","published":"2024-12-02T14:32:12Z","modified":"2025-01-24T20:03:06Z","title":"Spring Security Authorization Bypass for Case Sensitive Comparisons","vendor":"Spring by VMware Tanzu","product":"Spring Security","tier":"tail","description":{"text":"The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.8,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00377,"percentile":0.31653,"provenance":"source"},"cwes":[{"id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key"}],"references":[{"url":"https://spring.io/security/cve-2024-38827","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20250124-0007/","tags":[]}],"priority":{"score":9.7,"factors":[{"name":"EPSS percentile","points":6.33},{"name":"CVSS severity","points":3.36}]},"vendorSlug":"spring-by-vmware-tanzu","affectedVersions":[{"vendor":"Spring by VMware Tanzu","product":"Spring Security","versions":["5.7.0 - 5.7.13, 5.8.0 - 5.8.15, 6.0.0 - 6.0.13, 6.1.0 - 6.1.11, 6.2.0 - 6.2.7, 6.3.0 - 6.3.4, Older unsupported versions are also affected"]}],"affected":[{"ecosystem":"Maven","package":"org.springframework.security:spring-security-core","vulnerableRanges":["<5.7.14",">=5.8.0, <5.8.16",">=6.0.0, <6.0.14",">=6.1.0, <6.1.12",">=6.2.0, <6.2.8",">=6.3.0, <6.3.5"],"patched":["5.7.14","5.8.16","6.0.14","6.1.12","6.2.8","6.3.5"],"from":["GHSA-q3v6-hm2v-pw99"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3496","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-spring-framework-cve-2022-22950","parents":[{"from":"CVE-2023-20861","to":"CVE-2024-38827","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["spring-expression/src/main/java/org/springframework/expression/spel/standard/InternalSpelExpressionParser.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/430fc25acad2e85cbdddcd52b64481691f03ebd1","https://github.com/spring-projects/spring-framework/commit/52c93b1c4b24d70de233a958e60e7c5822bd274f","https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc9"],"basis":"rarely changed file"}]},{"from":"CVE-2023-20863","to":"CVE-2024-38827","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["spring-expression/src/main/java/org/springframework/expression/spel/standard/InternalSpelExpressionParser.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/965a6392757d20f9db19241126fcc719a51eac15","https://github.com/spring-projects/spring-framework/commit/b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e","https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc9"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-20862","published":"2023-04-19","fixed":"6.0.3","kev":false,"link":{"from":"CVE-2023-20862","to":"CVE-2024-38827","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework.security:spring-security-core","fromFixed":"6.0.3","toFixed":"6.0.14","daysApart":593}]}},{"cve":"CVE-2024-22234","published":"2024-02-20","fixed":"6.2.2","kev":false},{"cve":"CVE-2024-22257","published":"2024-03-18","fixed":"6.2.3","kev":false,"link":{"from":"CVE-2024-22257","to":"CVE-2024-38827","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework.security:spring-security-core","fromFixed":"5.7.12","toFixed":"5.7.14","daysApart":259},{"kind":"version-step","provenance":"source","package":"Maven:org.springframework.security:spring-security-core","fromFixed":"6.1.8","toFixed":"6.1.12","daysApart":259}]}},{"cve":"CVE-2024-38810","published":"2024-08-20","fixed":"6.3.2","kev":false,"link":{"from":"CVE-2024-38810","to":"CVE-2024-38827","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework.security:spring-security-core","fromFixed":"6.3.2","toFixed":"6.3.5","daysApart":104}]}},{"cve":"CVE-2024-38827","published":"2024-12-02","fixed":"6.3.5","kev":false},{"cve":"CVE-2025-22223","published":"2025-03-24","fixed":"6.4.4","kev":false},{"cve":"CVE-2025-22234","published":"2026-01-22","fixed":"6.4.5","kev":false},{"cve":"CVE-2025-41232","published":"2025-05-21","fixed":"6.4.6","kev":false}],"package":"Maven:org.springframework.security:spring-security-core"}}