VMware Spring fixes 3 vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] VMware Spring fixes 3 vulnerabilities

VMware fixes 3 vulnerabilities in its products. Products and their fixes: Spring Framework - 5.3.41, 6.0.25 and 6.1.14 [1][2] Spring Security - 5.7.13, 5.8.15, 6.0.13, 6.1.11, 6.2.7 and 6.3.4 [3]

VMware Spring - path traversal (CVE-2024-38819)

CVSS 7.5 (High)

An unauthenticated remote attacker is able, using malicious HTTP requests, to obtain any file in the file system that is also accessible to the process in which the Spring application is running [1].

The vulnerability is present in product:

Spring Framework; >=5.3.0, <=5.3.40; >=6.0.0, <=6.0.24; >=6.1.0, <=6.1.13

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

CVE-2024-38819 at cve.org, NVD
CWE-35: Path Traversal: '.../...//' at cwe.mitre.org

The vulnerability was publicly disclosed 17. 11. 2024.

VMware Spring - sensitive match exception (CVE-2024-38820)

CVSS 5.3 (Medium)

An unauthenticated remote attacker is able to bypass the protection of certain fields because the fix for CVE-2022-22968 changed the disallowedFields patterns in DataBinder to be case-insensitive. However, the String.toLowerCase() method has some "Locale"-dependent exceptions, which may potentially lead to some fields not being protected as expected [2].

The vulnerability is present in product:

Spring Framework; >=5.3.0, <=5.3.40; >=6.0.0; <=6.0.24; >=6.1.0, <=6.1.13

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

More information:

CVE-2024-38820 at cve.org, NVD
CWE-178: Improper Handling of Case Sensitivity at cwe.mitre.org

The vulnerability was publicly disclosed 17. 11. 2024.

VMware Spring - authorization bypass (CVE-2024-38821)

CVSS 9.1 (Critical)

An unauthenticated remote attacker is able to bypass authorization for static resources in Spring WebFlux applications, if it is a WebFlux application that uses Spring's static resource support and has a "non-permitAll" authorization rule set on these resources [3].

The vulnerability is present in product:

Spring Security; >=5.7.0 ,<=5.7.12; >=5.8.0, <=5.8.14; >=6.0.0; <=6.0.12; >=6.1.0, <=6.1.10; >=6.2.0, <=6.2.6; >=6.3.0, <=6.3.3

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

More information:

CVE-2024-38821 at cve.org, NVD
CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org

The vulnerability was publicly disclosed 25. 10. 2024.

Links

By CESNET, z.s.p.o. Michaela Jarošová on 4. 11. 2024.

Report feedback

[TLP:CLEAR] VMware Spring fixes 3 vulnerabilities

VMware Spring - path traversal (CVE-2024-38819)

CVSS 7.5 (High)

VMware Spring - sensitive match exception (CVE-2024-38820)

CVSS 5.3 (Medium)

VMware Spring - authorization bypass (CVE-2024-38821)

CVSS 9.1 (Critical)

Links