In short
- CVE-2024-38808 is a MEDIUM (CVSS 4.3) vulnerability affecting org.springframework:spring-expression, spring framework (vmware).
- Chance of exploitation in the next 30 days (EPSS): 0.57%, higher than 47.1% of all vulnerabilities.
- Fix: update to 5.3.39 or later.
Description
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Older, unsupported versions are also affected.
Specifically, an application is vulnerable when the following is true:
- The application evaluates user-supplied SpEL expressions.
NVD description
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.
Specifically, an application is vulnerable when the following is true:
* The application evaluates user-supplied SpEL expressions.
More vulnerabilities in org.springframework:spring-expression
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free