VMware Spring LDAP up to 2.4.3/3.0.9/3.1.7/3.2.7 String.toLowerCase/String.toUpperCase case sensitivity

Summaryinfo

A vulnerability marked as problematic has been reported in VMware Spring LDAP up to 2.4.3/3.0.9/3.1.7/3.2.7. The affected element is the function String.toLowerCase/String.toUpperCase. Performing a manipulation results in case sensitivity. This vulnerability is identified as CVE-2024-38829. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in VMware Spring LDAP up to 2.4.3/3.0.9/3.1.7/3.2.7. This affects the function String.toLowerCase/String.toUpperCase. The manipulation with an unknown input leads to a case sensitivity vulnerability. CWE is classifying the issue as CWE-178. The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results. This is going to have an impact on confidentiality. The summary by CVE is:

A vulnerability in VMware Tanzu Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820

The advisory is shared at spring.io. This vulnerability is uniquely identified as CVE-2024-38829 since 06/20/2024. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 2.4.4, 3.0.10, 3.1.8 or 3.2.8 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Directory Service Software

Vendor

• VMware

Name

• Spring LDAP

Version

• 2.4.0
• 2.4.1
• 2.4.2
• 2.4.3
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6
• 3.1.7
• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 3.2.7

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion