PT-2024-7497 · Spring · Spring Webflux

Tkswifty · Published 2024-10-25 · Updated 2026-05-25 · CVE-2024-38821

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Spring WebFlux (affected versions not specified)

Description: The issue is caused by weaknesses in the authorization procedure of the Spring Framework's WebMvc.fn and WebFlux.fn functional web frameworks. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. For an application to be affected, it must be a WebFlux application, use Spring's static resources support, and have a non-permitAll authorization rule applied to the static resources support. An exploit for this issue has been released and is being actively exploited.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Allocation of Resources Without Limits

Weakness Enumeration

CWE-285

CWE-770

Related Identifiers

BDU:2024-08880

CLEANSTART-2026-KP10590

CVE-2024-38821

GHSA-C4Q5-6C82-3QPW

Affected Products

Spring Webflux

References · 46

• 🔥 https://github.com/mouadk/cve-2024-38821 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-47561 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38821 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-3505 · Security Note
• https://osv.dev/vulnerability/GHSA-c4q5-6c82-3qpw · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08880 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-7962 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-KP10590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22257 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2024-38821 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5588 · Security Note
• https://github.com/spring-projects/spring-security · Note
• https://github.com/spring-projects/spring-security/commit/4ce7cde15599c0447163fd46bac616e03318bf5b · Note
• https://github.com/spring-projects/spring-security/commit/0e257b56ce35402558a260ffa6b368982f9a7934 · Note
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KP10590.json · Note