ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2024-38808

—
CVSS 3.1
4.3 medium
EPSS
<1%p45
Published
()
Modified
Description

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.

Vendors
vmwarenetapp
Products
spring framework, active iq unified manager, oncommand insight
Weakness
CWE-770
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news

No ingested article mentions this CVE yet.