PT-2024-28233 · Vmware+1 · Vmware Spring+1

Marek Parfianowicz · CVE-2024-38820 · Published 2024-10-17 · Updated 2026-06-23

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions VMware Spring versions prior to 6.1.13

Description The issue concerns improper access controls via DataBinder and String.toLowerCase(), which has locale-dependent exceptions. This could result in fields not being protected as expected, potentially leading to unauthorized access.

Recommendations For versions prior to 6.1.13, upgrade the affected components immediately to resolve the issue. As a temporary workaround, consider restricting access to sensitive fields until the upgrade is applied.

Exploit

Fix

Weakness Enumeration

CWE-178

Related Identifiers

CLEANSTART-2026-SQ91016

CLEANSTART-2026-WK99982

CVE-2024-38820

GHSA-4GC7-5J7H-4QPH

Affected Products

Debian

Vmware Spring

References · 167

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38820.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59419 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38820 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48924 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22569 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-53864 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-2047 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33870 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-38820 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-41249 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2024-38820 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38808 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-22233 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68161 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-42503 · Security Note