In breve
- CVE-2024-38808 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda org.springframework:spring-expression, spring framework (vmware).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.57%, superiore al 47.1% delle vulnerabilità.
- Correzione: aggiornare a 5.3.39 o successiva.
Description
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Older, unsupported versions are also affected.
Specifically, an application is vulnerable when the following is true:
- The application evaluates user-supplied SpEL expressions.
NVD description
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.
Specifically, an application is vulnerable when the following is true:
* The application evaluates user-supplied SpEL expressions.
Altre vulnerabilità di org.springframework:spring-expression
Vedi tutto →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free