CVE-2024-38821
Authorization Bypass of Static Resources in WebFlux Applications
CRITICAL 9.3EPSS 1.7%
Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.For this to impact an application, all of the following must be true: * It must be a WebFlux application * It must be using Spring's static resources support * It must have a non-permitAll authorization rule applied to the static resources support
- Affected
- Spring
- CVSS v4.0 GitHub
- 9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS v3.1 VMWARE
- 9.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - EPSS
- 1.74% chance of exploitation in the next 30 days, 77th percentile
- Published
- 2024-10-28
- Updated
- 2025-01-24
Proof-of-concept exploits (2)
- masa42/CVE-2024-38821-POC1★ · 2025-01-18
- mouadk/cve-2024-388212★ · 2024-10-30