Input validation error in Spring Framework - CVE-2024-38828

Vulnerability identifier: #VU100680

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-38828

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input  passed via Spring MVC controller method with @RequestBody byte[] parameter. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Spring Framework
IBM Cloud Pak for Security
Enterprise Project Connection
IBM Rational Build Forge
Oracle Enterprise Command Center Framework
Oracle Middleware Common Libraries and Tools
IBM Cloud Pak for Business Automation
QRadar Suite
watsonx.data
Library Support for Spring
DB2 Data Management Console
OpenPages for IBM Cloud Pak for Data
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
DevOps Solution Workbench
IBM Tivoli Netcool Configuration Manager
OpenPages Cloud pak for data service version
Telco Service Design Configuration Designer
Telco Network Function Virtualization Orchestrator
IBM Cognos Controller
Operational Decision Manager
IBM InfoSphere Information Server

Install updates from vendor's website.

Spring Framework - update to 5.3.42
IBM Cloud Pak for Security - update to 1.11.3.0
QRadar Suite - update to 1.11.3.0
watsonx.data - update to 2.1.2
DB2 Data Management Console - update to 3.1.13.2
OpenPages for IBM Cloud Pak for Data - update to 5.2.2
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
IBM Tivoli Netcool Configuration Manager - update to 6.4.2.22
IBM Rational Build Forge - update to 8.0.0.29
OpenPages Cloud pak for data service version - update to 9.5.2
IBM Cognos Controller - update to 11.1.2
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF007, 24.0.1-IF006, 25.0.0-IF003
Telco Service Design Configuration Designer - update to 2.3.0
Telco Network Function Virtualization Orchestrator - update to 7.3.0
Operational Decision Manager - addressed in versions 8.11.0.1 Interim fix 49, 8.11.1 Interim fix 47, 8.12.0.1 Interim fix 31, 9.0.0.1 Interim fix 15, 9.5.0.0 Interim fix 7
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5

• https://spring.io/security/cve-2024-38828

• Remote denial of service in Spring Framework
• Multiple vulnerabilities in SAP Enterprise Project Connection
• Multiple vulnerabilities in IBM Tivoli Network Configuration Manager
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Input validation error in Oracle Enterprise Command Center Framework
• IBM watsonx.data update for Spring MVC
• Multiple vulnerabilities in IBM Cloud Pak for Security and IBM QRadar Suite Software
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for Spring MVC
• Multiple vulnerabilities in HPE Telco Network Function Virtualization Orchestrator Software
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools
• Multiple vulnerabilities in IBM DevOps Solution Workbench
• Multiple vulnerabilities in IBM OpenPages for Cloud Pak for Data
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in IBM DB2 Data Management Console
• Multiple vulnerabilities in IBM Controller
• Multiple vulnerabilities in IBM Rational Build Forge
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Library Support for Spring