For Tridion Sites 10.0, is there a hotfix available for CVE-2024-38819?

Article Number:000023009 | Last Updated:1/9/2025 5:13 PM

Scope/Environment

Tridion Sites 10.0

Symptoms/Context

Security scans reports that the Tridion Sites 10.0 microservices (ie the Deployer) has spring-web-5.3.27.jar, for which the CVE-2024-38819 vulnerability is applicable. At the time this article was written, the latest CD hotfix CD_12.0.0_40704 had spring-web-5.3.37.jar, and in CVE-2024-38819 the fix version is 5.3.41.

Resolution

Tridion Sites doesn't use the functional version of SpringMvc, so is not impacted by this vulnerability.

Root Cause

Reference

https://spring.io/security/cve-2024-38819

Send Article Feedback