A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects
    Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0
    through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase() and String.toUpperCase()
    has some Locale dependent exceptions that could potentially result in unintended columns from being
    queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820 (CVE-2024-38829)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects     Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0     through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase() and String.toUpperCase()     has some Locale dependent exceptions that could potentially result in unintended columns from being     queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820 (CVE-2024-38829)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459394	Echo: org.springframework.ldap:spring-ldap-core: security update to 2.4.4	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459394	Echo: org.springframework.ldap:spring-ldap-core: security update to 2.4.4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
259675	Linux Distros Unpatched Vulnerability : CVE-2024-38829	Nessus	Misc.	Local	low
417103	SCA: security update for org.springframework.ldap:spring-ldap-core (GHSA-mqvr-2rp8-j7h4)	Tenable Cloud Security	SCA Checks	Local	medium
417103	SCA: security update for org.springframework.ldap:spring-ldap-core (GHSA-mqvr-2rp8-j7h4)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2024-38829

medium

Tenable Plugins

medium

medium

low

medium

medium