Skip to main content

Authorization Bypass Through User-Controlled Key

CVE-2024-38827

Medium
6.3/10

Summary

The usage of 'String.toLowerCase()' and 'String.toUpperCase()' has some Locale dependent exceptions that could potentially result in authorization rules not working properly. This issue affects the org.springframework.security packages in versions prior to 5.7.14, 5.8.x prior to 5.8.16, 6.0.x prior to 6.0.14, 6.1.x prior to 6.1.12, 6.2.x prior to 6.2.8, 6.3.x prior to 6.3.5, and 6.4.x prior to 6.4.0.

  • HIGH
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-639 - Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References

Advisory Timeline

  • Published