MEDIUM4.8
GHSA-q3v6-hm2v-pw99
Spring Framework has Authorization Bypass for Case Sensitive Comparisons
Quick fix
GHSA-q3v6-hm2v-pw99 — org.springframework.security:spring-security-core: upgrade to the fixed version with the command below.
# pom.xml: bump <version>5.7.14</version> for org.springframework.security:spring-security-coreDetails
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.springframework.security:spring-security-core
Introduced in:
0Fixed in: 5.7.14Fix
# pom.xml: bump <version>5.7.14</version> for org.springframework.security:spring-security-coreMaven/org.springframework.security:spring-security-core
Introduced in:
5.8.0Fixed in: 5.8.16Fix
# pom.xml: bump <version>5.8.16</version> for org.springframework.security:spring-security-coreMaven/org.springframework.security:spring-security-core
Introduced in:
6.0.0Fixed in: 6.0.14Fix
# pom.xml: bump <version>6.0.14</version> for org.springframework.security:spring-security-coreMaven/org.springframework.security:spring-security-core
Introduced in:
6.1.0Fixed in: 6.1.12Fix
# pom.xml: bump <version>6.1.12</version> for org.springframework.security:spring-security-coreMaven/org.springframework.security:spring-security-core
Introduced in:
6.2.0Fixed in: 6.2.8Fix
# pom.xml: bump <version>6.2.8</version> for org.springframework.security:spring-security-coreMaven/org.springframework.security:spring-security-core
Introduced in:
6.3.0Fixed in: 6.3.5Fix
# pom.xml: bump <version>6.3.5</version> for org.springframework.security:spring-security-coreReferences
- https://nvd.nist.gov/vuln/detail/CVE-2024-38827[ADVISORY]
- https://github.com/spring-projects/spring-framework/issues/33708[WEB]
- https://github.com/spring-projects/spring-framework/issues/34232[WEB]
- https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc9[WEB]
- https://github.com/spring-projects/spring-security[PACKAGE]
- https://security.netapp.com/advisory/ntap-20250124-0007[WEB]
- https://spring.io/security/cve-2024-38827[WEB]