CVE-2024-38808

2024-08-2008:15:05

vmware

web.nvd.nist.gov

100

spring framework

cve-2024-38808

dos

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

AI Score

4.6

Confidence

High

EPSS

Percentile

9.5%

JSON

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.

Specifically, an application is vulnerable when the following is true:

The application evaluates user-supplied SpEL expressions.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "packageName": "Spring Framework",
    "product": "Spring Framework",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "5.3.39, 6.0+",
        "status": "affected",
        "version": "5.3.0",
        "versionType": "5.3.396.0"
      }
    ]
  }
]