CVE-2024-38821 - CVE House
Back to Database
Status published Critical CVE-2024-38821

Authorization Bypass of Static Resources in WebFlux Applications

Vulnerability Description

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: * It must be a WebFlux application * It must be using Spring's static resources support * It must have a non-permitAll authorization rule applied to the static resources support

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-38821

Credits & Attribution

No credits recorded in the NVD database.

References

More from Spring

View All →
CVE-2025-41243
Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux
Critical 10
CVE-2025-41232
CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods
Critical 9.1
CVE-2025-22235
Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed
High 7.3
CVE-2025-22234
Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation
Medium 5.3
CVE-2025-22233
Spring Framework DataBinder Case Sensitive Match Exception
Low 3.1

Affected Vendor

Affected Software

Spring
Vulnerable Versions:
5.7.x, 5.8.x, 6.0.x, 6.1.x, 6.2.x, 6.3.x

Timeline

Official Publish: October 28th, 2024
Last Modified: January 24th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.