Medium

Analysis Summary

CVE-2024-38809 CVSS:5.3

VMware Tanzu Spring Framework is vulnerable to a denial of service, caused by improper input validation. By sending a specially crafted HTTP request containing ETags from "If-Match" or "If-None-Match" request headers, a remote attacker could exploit this vulnerability to cause a denial of service condition.

CVE-2024-38808 CVSS:7.5

VMware Tanzu Spring Framework is vulnerable to a denial of service, caused by improper input validation. By sending a specially crafted Spring Expression Language (SpEL) expression, a remote attacker could exploit this vulnerability to cause a denial of service condition.

Impact

• Denial of Service

Indicators of Compromise

CVE

• CVE-2024-38809
• CVE-2024-38808

Affected Vendors

Affected Products

Remediation

Upgrade to the latest version of VMware Tanzu, available from the VMware Website.

CVE-2024-38809

CVE-2024-38808