What is CVE-2024-38807?

CVE-2024-38807 is a medium-severity vulnerability in Spring Boot, classified under Authentication Bypass by Spoofing. CVSS score: 6.3/10. Published 2024-08-23.

How severe is CVE-2024-38807?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Is CVE-2024-38807 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Spring Boot

CVE-2024-38807

Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.

EPSS: 0.001 (2.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Spring Boot — versions 2.7.x, 3.0.x, 3.1.x

Weakness classification (CWE)

Public proof-of-concept exploits

zhanpengliu-tencent/medium-cve

References

Frequently asked questions

What is CVE-2024-38807?: CVE-2024-38807 is a medium-severity vulnerability in Spring Boot, classified under Authentication Bypass by Spoofing. CVSS score: 6.3/10. Published 2024-08-23.
How severe is CVE-2024-38807?: Medium severity. CVSS v3 base score is 6.3 out of 10.
Is CVE-2024-38807 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.