CVE-2024-38820

CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

Affected

VMware · Spring

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v3.1 VMWARE

3.1 LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.62% chance of exploitation in the next 30 days, 49th percentile

Published

2024-10-18

Updated

2024-11-29

Proof-of-concept exploits (1)

• kadamnayan/POC-CVE-2024-388200★ · 2025-10-06

Security advisories

• https://spring.io/security/cve-2024-38820
• advisories/GHSA-4gc7-5j7h-4qph

References

• CVE Record
• NVD entry

Related

• CVE-2022-22968
• CVE-2025-24793