Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn moreCVE-2024-38820 ensured Locale-independent,
lowercase conversion for both the configured disallowedFields
patterns and for request parameter names.
However, there are still cases where it is possible to bypass the disallowedFields
checks.
Spring Framework:
Users of affected versions should upgrade to the corresponding fixed version.
Affected version(s) | Fix version | Availability |
---|---|---|
6.2.x | 6.2.7 | OSS |
6.1.x | 6.1.20 | OSS |
6.0.x | 6.0.28 | Commercial |
5.3.x | 5.3.43 | Commercial |
No further mitigation steps are necessary.
Generally, we recommend using a dedicated model object with properties only for data binding, or
using constructor binding since constructor arguments explicitly declare what to bind together with
turning off setter binding through the declarativeBinding
flag.
See the Model Design
section in the reference documentation.
For setting binding, prefer the use of allowedFields
(an explicit list) over disallowedFields
.
This issue was responsibly reported by the TERASOLUNA Framework Development Team from NTT DATA Group Corporation.
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy