CVE-2024-38808

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.

Score

CVSS 3.1 4.3 Medium

Status

Analyzed - security@vmware.com

Published

2024-08-20

Last modified

2024-10-30

Weaknesses

CWE-770

Affected products

• Active Iq Unified Manager (Netapp)
• Oncommand Insight (Netapp)
• Spring Framework (Spring)
• Spring Framework (Vmware)

References

• https://spring.io/security/cve-2024-38808
• https://security.netapp.com/advisory/ntap-20240920-0002/