CVE-2024-38808mediumCWE-770

CVE-2024-38808: fallo de gravedad media en Spring Framework

CVE-2024-38808: Spring Expression DoS Vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Spring Framework+ Monitorear libspring-java

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.3epss 0.6%
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Productos afectados
Spring · Spring Framework
CVEs relacionadas — Spring Framework

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-5398HIGHRFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux ApplicationEPSS 88.3%CVE-2024-22243HIGHCVE-2024-22243: Spring Framework URL Parsing with Host ValidationEPSS 4.0%CVE-2024-22259HIGHCVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)EPSS 2.6%CVE-2020-5397MEDIUMCSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFluxEPSS 2.6%CVE-2024-22262HIGHCVE-2024-22262: Spring Framework URL Parsing with Host ValidationEPSS 1.2%CVE-2023-34053MEDIUMSpring Framework server Web Observations DoS VulnerabilityEPSS 1.2%