Open mend-bolt-for-github[bot] opened 1 month ago
Spring Framework: Web
Library home page: http://www.springframework.org/
Path to vulnerable library: /target/libs/provided/spring-web-2.0.6.jar
Dependency Hierarchy: - :x: **spring-web-2.0.6.jar** (Vulnerable Library)
Found in HEAD commit: a0333a35ad0999ab53fcccf6540d431239f0b20a
Found in base branch: main
Spring Framework is vulnerable DoS via conditional HTTP request. Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to Denial of Service attack. All versions before 5.3.38, 6.0.23 and 6.1.12 are affected.
Publish Date: 2024-06-20
URL: CVE-2024-38809
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
Type: Upgrade version
Origin: https://spring.io/security/cve-2024-38809
Release Date: 2024-06-20
Fix Resolution: 5.3.38
Step up your Open Source Security Game with Mend here
CVE-2024-38809 - Medium Severity Vulnerability
Spring Framework: Web
Library home page: http://www.springframework.org/
Path to vulnerable library: /target/libs/provided/spring-web-2.0.6.jar
Dependency Hierarchy: - :x: **spring-web-2.0.6.jar** (Vulnerable Library)
Found in HEAD commit: a0333a35ad0999ab53fcccf6540d431239f0b20a
Found in base branch: main
Spring Framework is vulnerable DoS via conditional HTTP request. Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to Denial of Service attack. All versions before 5.3.38, 6.0.23 and 6.1.12 are affected.
Publish Date: 2024-06-20
URL: CVE-2024-38809
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://spring.io/security/cve-2024-38809
Release Date: 2024-06-20
Fix Resolution: 5.3.38
Step up your Open Source Security Game with Mend here