Vulnerability Description
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Spring Framework | >= 5.3.0, < 5.3.39 |
| Netapp | Active Iq Unified Manager | - |
| Netapp | Oncommand Insight | - |
Related Weaknesses (CWE)
References
- https://spring.io/security/cve-2024-38808Vendor Advisory
- https://security.netapp.com/advisory/ntap-20240920-0002/Third Party Advisory
FAQ
What is CVE-2024-38808?
CVE-2024-38808 is a vulnerability with a CVSS score of 4.3 (MEDIUM). In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denia...
How severe is CVE-2024-38808?
CVE-2024-38808 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-38808?
Check the references section above for vendor advisories and patch information. Affected products include: Vmware Spring Framework, Netapp Active Iq Unified Manager, Netapp Oncommand Insight.