IGA Suite Impact Assessment for CVE-2024-38819 Spring Framework Vulnerability

Products

• CA Identity Governance
• CA Identity Manager
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

This article addresses reports regarding CVE-2024-38819, a path traversal vulnerability in the Spring Framework functional web frameworks WebMvc.fn or WebFlux.fn. An attacker can craft malicious HTTP requests to obtain files from the file system accessible to the Spring application process.

https://spring.io/security/cve-2024-38819

 

Environment

Product: CA Identity Suite (Identity Manager, Identity Governance, Identity Portal)
Release: 14.5

Cause

The vulnerability exists if the web application serves static resources through functional web frameworks and resource handling is explicitly configured with a FileSystemResource location.

Resolution

The CVE-2024-38819 vulnerability does not impact the IGA Suite as the specific vulnerable configurations are not utilized.

There are no plans to update Spring jars in the 14.5 version. The update to Spring 6.x is planned as part of the IGA 15 release.