spring-webmvc-6.2.1.jar: 1 vulnerabilities (highest severity is: 5.3)

[mend-bolt-for-github]

Vulnerable Library - spring-webmvc-6.2.1.jar

Spring Web MVC

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-webmvc/6.2.1/44bdf7e5641d44044ac52d7bb5c1fc46004e7754/spring-webmvc-6.2.1.jar

Found in HEAD commit: c9f0c0df3aeb15b9978bd7f10ac66a7913f5a284

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (spring-webmvc version)	Remediation Possible**
CVE-2024-38828	Medium	5.3	spring-webmvc-6.2.1.jar	Direct	N/A	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-38828

Vulnerable Library - spring-webmvc-6.2.1.jar

Spring Web MVC

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-webmvc/6.2.1/44bdf7e5641d44044ac52d7bb5c1fc46004e7754/spring-webmvc-6.2.1.jar

Dependency Hierarchy:

• ❌ spring-webmvc-6.2.1.jar (Vulnerable Library)

Found in HEAD commit: c9f0c0df3aeb15b9978bd7f10ac66a7913f5a284

Found in base branch: develop

Vulnerability Details

Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

Publish Date: 2024-11-18

URL: CVE-2024-38828

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

[krusche]

I believe this is a false positive:

1. We already use the latest version spring-webmvc 6.2.1
2. The linked CVE on https://spring.io/security/cve-2024-38828 mentions Spring 5.3.x and not 6.2.x