CVE-2024-38829 LOW

CVE-2024-38829: Spring LDAP sensitive data exposure for case-sensitive comparisons

Vendor Spring
Product Spring LDAP
Weakness CWE-178
Published December 4, 2024
Last update December 10, 2024
View on NVD All CVEs

CVSS base score

3.7/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820

Key dates

02Disclosure timeline

December 4, 2024 CVE published
December 10, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-3833 Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison CVE-2025-67718 Formio improperly authorized permission elevation through specially crafted request path CVE-2026-27588 Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass CVE-2021-39155 Authorization Policy Bypass Due to Case Insensitive Host Comparison CVE-2026-32939 DataEase is Vulnerable to H2 JDBC RCE Bypass