VulnerabilityDeferred

CVE-2024-38821

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.

CRITICAL 9.1EPSS 1.74%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.74%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: * It must be a WebFlux application * It must be using Spring's static resources support * It must have a non-permitAll authorization rule applied to the static resources support

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 1.74% probability · 76th percentile
CISA KEV: Not listed
Weakness: CWE-770
Source: security@vmware.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.