PT-2024-8762 · Unknown · Spring Security

Published 2024-11-19 · Updated 2026-05-18 · CVE-2024-38827

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Spring Security (affected versions not specified)

Description The issue is related to the use of String.toLowerCase() and String.toUpperCase() functions in the Java framework for Spring Security, which can lead to improper authorization. This is due to locale-dependent exceptions that may cause authorization rules to not work correctly. An attacker could potentially exploit this to bypass the authorization process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Improper Authorization

Weakness Enumeration

CWE-639

CWE-285

Related Identifiers

BDU:2024-10377

CLEANSTART-2026-JU62349

CLEANSTART-2026-SQ91016

CLEANSTART-2026-SV95049

CLEANSTART-2026-WK99982

CVE-2024-38827

GHSA-Q3V6-HM2V-PW99

Affected Products

Spring Security

References · 160

• https://nvd.nist.gov/vuln/detail/CVE-2022-3510 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-40167 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3171 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-2047 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24970 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-36479 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-5588 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-44981 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58057 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38827 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-6763 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-22233 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22569 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-34462 · Security Note