Security features bypass in Spring Framework - CVE-2024-38820

Vulnerability identifier: #VU98795

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-38820

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to String.toLowerCase() has some Locale dependent exceptions when handling case insensitive patterns in DataBinder. A remote attacker can bypass implemented security restrictions by passing specially crafted data to the application.

Spring Framework
Netcool Operations Insight
IBM Process Mining
Enterprise Project Connection
IBM Sterling B2B Integrator
IBM Sterling Partner Engagement Manager
IBM Sterling Connect:Direct Web Services
IBM Spectrum Symphony
IBM Rational Build Forge
IBM Common Licensing
IBM Maximo Application Suite - AI Broker
IBM Security Verify Governance
IBM Observability with Instana
IBM Cloud Pak for Security
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Dell Secure Connect Gateway
IBM SPSS Collaboration and Deployment Services
PowerProtect Data Manager
IBM Cloud Pak for Business Automation
IBM Business Automation Workflow
watsonx.data
DB2 Data Management Console
Guardium Data Security Center (GDSC)
OpenPages for IBM Cloud Pak for Data
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
DevOps Solution Workbench
Oracle BI Publisher
OpenPages Cloud pak for data service version
IBM Business Automation Manager Open Editions
IBM Engineering Requirements Management DOORS Next
CICS Transaction Gateway for Multiplatforms
CICS Transaction Gateway Desktop Edition
Telco Service Design Configuration Designer
Cloudera Observability with IBM
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
Telco Network Function Virtualization Orchestrator
Maximo Application Suite - IoT Component
Maximo Application Suite - Monitor Component
Business Automation Insights
IBM Sterling File Gateway
IBM Cognos Controller
Oracle Banking Liquidity Management
SAP Datahub
SAP Commerce Cloud
Library Support for Spring
Operational Decision Manager
IBM InfoSphere Information Server

Install updates from vendor's website.

Spring Framework - addressed in versions 5.3.41, 6.0.25, 6.1.14
Netcool Operations Insight - update to 1.6.15
IBM Process Mining - update to 2.0
watsonx.data - update to 2.1.3
DB2 Data Management Console - update to 3.1.13.2
Guardium Data Security Center (GDSC) - update to 3.8.1
OpenPages for IBM Cloud Pak for Data - update to 5.2.2
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2.0.1
DevOps Solution Workbench - update to 5.1
IBM Sterling File Gateway - addressed in versions 6.2.1.2, 6.2.2.0
IBM Sterling B2B Integrator - addressed in versions 6.2.1.2, 6.2.2.0
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
IBM Sterling Connect:Direct Web Services - addressed in versions 6.3.0.14, 6.4.0.3
IBM Spectrum Symphony - update to 7.3.2 FP3
IBM Rational Build Forge - update to 8.0.0.29
OpenPages Cloud pak for data service version - update to 9.5.2
IBM Common Licensing - update to 9.0.0.2
IBM Business Automation Manager Open Editions - update to 9.2.1
IBM Maximo Application Suite - AI Broker - update to 9.0.3
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.11
IBM Security Verify Governance - update to 10.0.2.0.7
IBM Cognos Controller - update to 11.1.2
IBM Observability with Instana - update to 286
IBM Cloud Pak for Security - update to 1.11.0.0
Telco Service Design Configuration Designer - update to 2.3.0
Library Support for Spring - update to 2.7.29
Cloudera Observability with IBM - update to 3.6.2
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.1.1
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.2.1
Dell Secure Connect Gateway - update to 5.28.00.14
Telco Network Function Virtualization Orchestrator - update to 7.3.0
IBM SPSS Collaboration and Deployment Services - update to 8.5.0.0.1
Maximo Application Suite - IoT Component - addressed in versions 8.7.21, 8.8.17, 9.0.7
Operational Decision Manager - addressed in versions 8.11.0.1 Interim fix 49, 8.11.1 Interim fix 47, 8.12.0.1 Interim fix 31, 9.0.0.1 Interim fix 15, 9.5.0.0 Interim fix 7
Maximo Application Suite - Monitor Component - update to 9.1.0
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
PowerProtect Data Manager - update to 19.19.0-15
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1
IBM Business Automation Workflow - addressed in versions 24.0.0-IF006, 24.0.1-IF005, 25.0.0-IF001
Business Automation Insights - addressed in versions 24.0.0.0.2, 24.0.1.0.1

• https://spring.io/security/cve-2024-38820

• Multiple vulnerabilities in Spring Framework
• IBM Maximo Application Suite - AI Broker update for VMware Tanzu Spring Framework
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in SAP Enterprise Project Connection
• IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data update for VMware Tanzu Spring Framework
• Multiple vulnerabilities in IBM Business Automation Insights
• SAP Commerce Cloud and SAP Datahub update for Spring Framework
• Multiple vulnerabilities in IBM InfoSphere Information Server
• IBM Maximo Application Suite - IoT Component update for VMware Tanzu Spring Framework
• Multiple vulnerabilities in Oracle Banking Liquidity Management
• Multiple vulnerabilities in Oracle BI Publisher
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in Dell PowerProtect Data Manager
• Multiple vulnerabilities in IBM watsonx
• IBM Maximo Application Suite - Monitor Component update for VMware Tanzu Spring Framework
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in IBM Sterling Connect:Direct Web Services
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in HPE Telco Network Function Virtualization Orchestrator Software
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Common Licensing
• Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM OpenPages for Cloud Pak for Data
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager Essentials Edition
• Multiple vulnerabilities in IBM Library Support for Spring
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in IBM DevOps Solution Workbench
• Multiple vulnerabilities in IBM DB2 Data Management Console
• Multiple vulnerabilities in IBM Controller
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Rational Build Forge
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS and DOORS Web Access
• Multiple vulnerabilities in IBM Cloudera Observability on Premises with IBM
• Multiple vulnerabilities in IBM Spectrum Symphony
• Multiple vulnerabilities in IBM Sterling B2B Integrator and IBM Sterling File Gateway
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition