En bref
- CVE-2024-38808 est une vulnérabilité MOYENNE (CVSS 4.3) touchant org.springframework:spring-expression, spring framework (vmware).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.57%, plus élevée que 47.1% des vulnérabilités.
- Correctif : mettre à jour vers 5.3.39 ou plus récent.
Description
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Older, unsupported versions are also affected.
Specifically, an application is vulnerable when the following is true:
- The application evaluates user-supplied SpEL expressions.
NVD description
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.
Specifically, an application is vulnerable when the following is true:
* The application evaluates user-supplied SpEL expressions.
Autres vulnérabilités de org.springframework:spring-expression
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free