VMware Spring Security up to 6.3.4 Authorization Rule String.toLowerCase/String.toUpperCase authorization

Summaryinfo

A vulnerability has been found in VMware Spring Security up to 6.3.4 and classified as problematic. Affected by this issue is the function String.toLowerCase/String.toUpperCase of the component Authorization Rule Handler. This manipulation causes authorization. The identification of this vulnerability is CVE-2024-38827. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in VMware Spring Security up to 6.3.4. It has been declared as problematic. Affected by this vulnerability is the function String.toLowerCase/String.toUpperCase of the component Authorization Rule Handler. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect confidentiality, and integrity. The summary by CVE is:

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

It is possible to read the advisory at spring.io. This vulnerability is known as CVE-2024-38827 since 06/20/2024. The exploitation appears to be difficult. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/25/2025).

Upgrading to version 5.7.14, 5.8.16, 6.0.14, 6.1.12, 6.2.8 or 6.3.5 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• VMware

Name

• Spring Security

Version

• 5.7.0
• 5.7.1
• 5.7.2
• 5.7.3
• 5.7.4
• 5.7.5
• 5.7.6
• 5.7.7
• 5.7.8
• 5.7.9
• 5.7.10
• 5.7.11
• 5.7.12
• 5.7.13
• 5.8.0
• 5.8.1
• 5.8.2
• 5.8.3
• 5.8.4
• 5.8.5
• 5.8.6
• 5.8.7
• 5.8.8
• 5.8.9
• 5.8.10
• 5.8.11
• 5.8.12
• 5.8.13
• 5.8.14
• 5.8.15
• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5
• 6.0.6
• 6.0.7
• 6.0.8
• 6.0.9
• 6.0.10
• 6.0.11
• 6.0.12
• 6.0.13
• 6.1.0
• 6.1.1
• 6.1.2
• 6.1.3
• 6.1.4
• 6.1.5
• 6.1.6
• 6.1.7
• 6.1.8
• 6.1.9
• 6.1.10
• 6.1.11
• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3
• 6.2.4
• 6.2.5
• 6.2.6
• 6.2.7
• 6.3.0
• 6.3.1
• 6.3.2
• 6.3.3
• 6.3.4

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion