Em resumo
- CVE-2024-38808 é uma vulnerabilidade MÉDIO (CVSS 4.3) que afeta org.springframework:spring-expression, spring framework (vmware).
- Chance de exploração nos próximos 30 dias (EPSS): 0.57%, maior que 47.1% das vulnerabilidades.
- Correção: atualize para 5.3.39 ou posterior.
Description
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Older, unsupported versions are also affected.
Specifically, an application is vulnerable when the following is true:
- The application evaluates user-supplied SpEL expressions.
NVD description
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.
Specifically, an application is vulnerable when the following is true:
* The application evaluates user-supplied SpEL expressions.
Mais vulnerabilidades de org.springframework:spring-expression
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free