Low severity · published Dec 4, 2024
CVE-2024-38829
Spring LDAP sensitive data exposure for case-sensitive comparisons
3.7
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried
Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SL
Spring LDAP · Spring
2.4.0 through 2.4.3; 3.0.0 through 3.0.9; 3.1.0 through 3.1.7; 3.2.0 through 3.2.7; through 2.4.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-38829
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-38829
spring.io
https://spring.io/security/cve-2024-38829
More from Spring LDAP
7.4
CVE-2026-41720
Authentication Bypass with Empty Password in Spring LDAP