mirror of
https://github.com/0xMarcio/cve.git
synced 2025-11-28 18:48:49 +00:00
18 lines
677 B
Markdown
18 lines
677 B
Markdown
|
### [CVE-2024-38820](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38820)
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
### Description
|
|||
|
|
|
|||
|
|
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
|
|||
|
|
|
|||
|
|
### POC
|
|||
|
|
|
|||
|
|
#### Reference
|
|||
|
|
No PoCs from references.
|
|||
|
|
|
|||
|
|
#### Github
|
|||
|
|
- https://github.com/diegopacheco/Smith
|
|||
|
|
|