Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2024-38807

Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.

VectorLOCAL

PublishedAug 23, 2024, 09:15

Published Bysecurity@vmware.com

Base Score

Score6.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.springframework.boot:spring-boot-loader(Maven)2.7.02.7.22N/A

org.springframework.boot:spring-boot-loader-classic(Maven)2.7.02.7.22N/A

org.springframework.boot:spring-boot-loader(Maven)3.0.03.0.17N/A

org.springframework.boot:spring-boot-loader-classic(Maven)3.0.03.0.17N/A

org.springframework.boot:spring-boot-loader(Maven)3.1.03.1.13N/A

org.springframework.boot:spring-boot-loader-classic(Maven)3.1.03.1.13N/A

org.springframework.boot:spring-boot-loader(Maven)3.2.03.2.9N/A

org.springframework.boot:spring-boot-loader-classic(Maven)3.2.03.2.9N/A

org.springframework.boot:spring-boot-loader(Maven)3.3.03.3.3N/A

org.springframework.boot:spring-boot-loader-classic(Maven)3.3.03.3.3N/A

References

Weakness Type

CWE-290

CVSS Metrics

Base Score

6.3

Vector String

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

LOCAL