{"action":"Upgrade org.springframework.security:spring-security-core to 5.7.14 (5.7.x), 5.8.16 (5.8.x), 6.0.14 (6.0.x), 6.1.12 (6.1.x), 6.2.8 (6.2.x) or 6.3.5 (6.3.x) or later.","affected":[{"fixed":"5.7.14","introduced":"0"},{"fixed":"5.8.16","introduced":"5.8.0"},{"fixed":"6.0.14","introduced":"6.0.0"},{"fixed":"6.1.12","introduced":"6.1.0"},{"fixed":"6.2.8","introduced":"6.2.0"},{"fixed":"6.3.5","introduced":"6.3.0"}],"component":"org.springframework.security:spring-security-core","cve_ids":["CVE-2024-38827"],"ecosystem":"Maven","epss":0.00377,"exploited":false,"fixed_versions":["5.7.14","5.8.16","6.0.14","6.1.12","6.2.8","6.3.5"],"ghsa_id":"GHSA-q3v6-hm2v-pw99","id":"tcs_01M5N98J32HXD7C94Z55CQQ7D8","modified_at":"2026-09-10T03:50:21.931277403Z","published_at":"2024-12-02T15:31:41Z","references":["https://osv.dev/vulnerability/GHSA-q3v6-hm2v-pw99","https://nvd.nist.gov/vuln/detail/CVE-2024-38827","https://github.com/spring-projects/spring-framework/issues/33708","https://github.com/spring-projects/spring-framework/issues/34232","https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc9","https://github.com/spring-projects/spring-security","https://security.netapp.com/advisory/ntap-20250124-0007","https://spring.io/security/cve-2024-38827"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-q3v6-hm2v-pw99","url":"https://osv.dev/vulnerability/GHSA-q3v6-hm2v-pw99"}],"summary":"Spring Framework has Authorization Bypass for Case Sensitive Comparisons"}