StackRadar

CVE-2024-38821

Critical

Advisory

Published 28 Oct 2024In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.017
76th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
91
of 17,781 indexed, latest versions
Container images
108
deployed by those charts
Fix available
1 of 1
affected package

Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications

Carried by container images the latest versions of 91 of 17,781 indexed charts deploy, on 108 images.

Affected packageAffected versionsFixed inImages
spring-security-webmaven5.1.5.RELEASE, 5.1.12.RELEASE, 5.2.1.RELEASE, 5.2.2.RELEASE+40 more5.7.13, 5.8.15, 6.0.13, 6.1.11+2 more108
OSV records
GHSA-c4q5-6c82-3qpw

Charts affected

91 by stars
ChartLatestAffected imagesRadar Score
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.82 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

2 of the 5 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
geonetwork/gn-cloud-ogc-api-records-service:4.2.8-020c9bb761f67
spring-security-web@5.3.6.RELEASE
5.7.13
jingking/geonetwork-hnap:4.2.843e74ab234e1
spring-security-web@5.7.11
5.7.13

Open the chart page →

34,754
siembolgresearch0.1.62 of 4See more

siembol gresearch 0.1.6

2 of the 4 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
gresearchdev/siembol-config-editor-rest:latest91863a50afb7
spring-security-web@5.7.4
5.7.13
gresearchdev/siembol-storm-topology-manager:latest8dad36a05ebf
spring-security-web@5.7.4
5.7.13

Open the chart page →

14,312
nacosheidaodageshiwoVerified publisher0.1.51 of 1See more

nacos heidaodageshiwo 0.1.5

1 of the 1 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
nacos/nacos-server:v2.1.0dcf04549c6d7
spring-security-web@5.1.12.RELEASE
5.7.13

Open the chart page →

3,978
chart-bookhelm-deploy-book0.1.01 of 3See more

chart-book helm-deploy-book 0.1.0

1 of the 3 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
dannielkil/book-backend:lateste3b479a55a69
spring-security-web@5.7.3
5.7.13

Open the chart page →

9,122
nifi-registryimprowisedVerified publisher1.0.01 of 2See more

nifi-registry improwised 1.0.0

1 of the 2 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
apache/nifi-registry:1.27.063b8e3e40742
spring-security-web@5.8.13
5.8.15

Open the chart page →

5,320
kron-aapm-agentkron-aapm-agent1.1.01 of 1See more

kron-aapm-agent kron-aapm-agent 1.1.0

1 of the 1 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
krontechnology/aapm-agent:1.1.07feef7d2ab42
spring-security-web@5.4.1
5.7.13

Open the chart page →

8,884
nacoskubesphere-testVerified publisher0.1.11 of 1See more

nacos kubesphere-test 0.1.1

1 of the 1 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
nacos/nacos-server:1.4.1fe6e5688cdf3
spring-security-web@5.1.12.RELEASE
5.7.13

Open the chart page →

4,153
elastictranscoderluiscajl0.46.03 of 4See more

elastictranscoder luiscajl 0.46.0

3 of the 4 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
elastictranscoder/media:627e21dc963ab3858c6b
spring-security-web@5.5.0
5.7.13
elastictranscoder/media-storage:f6d861a026208b8c2359
spring-security-web@5.5.0
5.7.13
elastictranscoder/transcoder-handler:627e21dc5b75d19e2733
spring-security-web@5.5.0
5.7.13

Open the chart page →

58,160
lavandaluiscajl0.0.1343 of 5See more

lavanda luiscajl 0.0.134

3 of the 5 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
lavandadelpatio/automated-download-films:0.0.2094e225a5a6f8
spring-security-web@5.3.4.RELEASE
5.7.13
lavandadelpatio/automated-download-shows:0.0.492de3c3426d2
spring-security-web@5.3.4.RELEASE
5.7.13
lavandadelpatio/filebot:0.0.671f2ccec8c0d
spring-security-web@5.4.5
5.7.13

Open the chart page →

18,248
resource-processormicroservices-learningVerified publisher1.2.01 of 1See more

resource-processor microservices-learning 1.2.0

1 of the 1 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
maksimkavalenka/microservices-learning.resource-processor:latest64a25afb8748
spring-security-web@6.1.4
6.1.11

Open the chart page →

3,683
resource-servicemicroservices-learningVerified publisher1.5.01 of 2See more

resource-service microservices-learning 1.5.0

1 of the 2 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
maksimkavalenka/microservices-learning.resource-service:latest13ad9bb170a0
spring-security-web@6.1.4
6.1.11

Open the chart page →

5,129
crowdmoxVerified publisher2.4.31 of 3See more

crowd mox 2.4.3

1 of the 3 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
atlassian/crowd:5.2.2ebf761c7d437
spring-security-web@5.5.8
5.7.13

Open the chart page →

5,663
file-system-ms-helm-chartnotesprojectchart0.1.01 of 2See more

file-system-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
vlebediantsev/file-system-ms-final:latest10393a89b4a8
spring-security-web@5.7.2
5.7.13

Open the chart page →

5,875
logic-ms-helm-chartnotesprojectchart0.1.01 of 2See more

logic-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
vlebediantsev/logic-ms:latestdf8bf38c535b
spring-security-web@5.7.2
5.7.13

Open the chart page →

6,852
registration-ms-helm-chartnotesprojectchart0.1.01 of 2See more

registration-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
vlebediantsev/registration-ms-final:latest427af418b75e
spring-security-web@5.7.2
5.7.13

Open the chart page →

5,916
user-data-ms-helm-chartnotesprojectchart0.1.01 of 2See more

user-data-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
vlebediantsev/user-data-ms-final-final:latest9319437f3c8f
spring-security-web@5.7.2
5.7.13

Open the chart page →

5,873
my-bloody-jenkinsodavid0.1.2181 of 1See more

my-bloody-jenkins odavid 0.1.218

1 of the 1 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
odavid/my-bloody-jenkins:2.462.3-306e7ab3bbc948e
spring-security-web@5.8.14
5.8.15

Open the chart page →

5,826
bpjstk-serviceopenshift1.0.03 of 6See more

bpjstk-service openshift 1.0.0

3 of the 6 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
andrianrf/backoffice-be:latest6036614803d4
spring-security-web@5.7.8
5.7.13
andrianrf/bpjstk-service:latest46abe878d9d8
spring-security-web@5.3.4.RELEASE
5.7.13
andrianrf/iso-client:latestba560086ce15
spring-security-web@5.3.4.RELEASE
5.7.13

Open the chart page →

34,671
smsf-configurationopenshift1.0.41 of 1See more

smsf-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
gurolakman/smsf-configuration:1.0.49abb3882bcbd
spring-security-web@5.6.2
5.7.13

Open the chart page →

13,607
smsf-momtopenshift1.0.41 of 1See more

smsf-momt openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
gurolakman/smsf-momt:1.0.4ce23b20a8a17
spring-security-web@5.6.2
5.7.13

Open the chart page →

13,568
smsf-registrationopenshift1.0.41 of 1See more

smsf-registration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
gurolakman/smsf-registration:1.0.4b22e746edd5d
spring-security-web@5.6.2
5.7.13

Open the chart page →

13,551
ussigw-configurationopenshift1.0.41 of 1See more

ussigw-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
spring-security-web@5.6.2
5.7.13

Open the chart page →

13,455
reportportalreportportal5.7.22 of 8See more

reportportal reportportal 5.7.2

2 of the 8 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
reportportal/service-api:5.7.29df41f8fb320
spring-security-web@5.2.4.RELEASE
5.7.13
reportportal/service-authorization:5.7.09e73114dbd15
spring-security-web@5.2.4.RELEASE
5.7.13

Open the chart page →

25,737
nacossaber0.1.111 of 1See more

nacos saber 0.1.11

1 of the 1 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
nacos/nacos-server:v2.1.0dcf04549c6d7
spring-security-web@5.1.12.RELEASE
5.7.13

Open the chart page →

3,978
kafkasb-helm-charts0.3.01 of 2See more

kafka sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
provectuslabs/kafka-ui:latest8f2ff02d64b0
spring-security-web@6.1.3
6.1.11

Open the chart page →

1,597
smartquerysearchhub0.1.01 of 1See more

smartquery searchhub 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
commerceexperts/smartquery-service:2.2.09e33ad89baf6
spring-security-web@5.7.10
5.7.13

Open the chart page →

1,528
seataseataVerified publisher0.1.01 of 1See more

seata seata 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
seataio/seata-server:latest703b5de7f1a6
spring-security-web@5.7.11
5.7.13

Open the chart page →

4,245
shenyushenyu0.6.31 of 2See more

shenyu shenyu 0.6.3

1 of the 2 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
apache/shenyu-bootstrap:2.5.11bd5756f6273
spring-security-web@5.6.5
5.7.13

Open the chart page →

8,804
shenyushenyu-helm-chart-test2.4.271 of 2See more

shenyu shenyu-helm-chart-test 2.4.27

1 of the 2 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
spring-security-web@5.2.1.RELEASE
5.7.13

Open the chart page →

12,513
sistas-chatbotsistas-chatbot5.0.21 of 6See more

sistas-chatbot sistas-chatbot 5.0.2

1 of the 6 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
jhipster/jhipster-registry:latest7184525acd4d
spring-security-web@5.7.3
5.7.13

Open the chart page →

5,856
umsappstacksimplifyVerified publisher1.0.01 of 3See more

umsapp stacksimplify 1.0.0

1 of the 3 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
ghcr.io/stacksimplify/kube-usermgmt-webapp:1.0.0-mysqldb41b45003c6b6
spring-security-web@5.1.5.RELEASE
5.7.13

Open the chart page →

6,101
static-src-people-detector-appstatic-src-people-detector-chartVerified publisher1.5.51 of 6See more

static-src-people-detector-app static-src-people-detector-chart 1.5.5

1 of the 6 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
fimperato/detected-info-notification:1.2.6-RELEASE6441f6545613
spring-security-web@5.7.5
5.7.13

Open the chart page →

13,646
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
spring-security-web@5.8.3
5.8.15

Open the chart page →

18,756
shenyutest-helm2.4.211 of 2See more

shenyu test-helm 2.4.21

1 of the 2 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
spring-security-web@5.2.1.RELEASE
5.7.13

Open the chart page →

12,513
thingsboardthingsboardVerified publisher0.1.31 of 12See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
thingsboard/tb-node:3.4.1645f43b688f7
spring-security-web@5.7.1
5.7.13

Open the chart page →

25,394
togglr-backendtogglrVerified publisher1.0.01 of 1See more

togglr-backend togglr 1.0.0

1 of the 1 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
gdrocha/togglr-backend:1.0.0d5ae64e83d4c
spring-security-web@6.1.5
6.1.11

Open the chart page →

3,221
webhookiewebhookie0.1.21 of 1See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
spring-security-web@5.6.1
5.7.13

Open the chart page →

14,364
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
spring-security-web@5.6.1
5.7.13

Open the chart page →

28,605
hazelcastwenerme5.10.21 of 2See more

hazelcast wenerme 5.10.2

1 of the 2 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
hazelcast/management-center:5.5.2991ddb27c251
spring-security-web@6.3.3
6.3.4

Open the chart page →

2,634
workshop-pipelinesworkshop-pipelines0.1.61 of 2See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
spring-security-web@6.2.0
6.2.7

Open the chart page →

11,577
zahori-serverzahoriVerified publisher1.0.11 of 2See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2024-38821.

Container imageDigestPackageFixed in
zahoriaut/zahori-server:0.1.17b2de13916f3e
spring-security-web@5.7.6
5.7.13

Open the chart page →

5,846

Container images carrying it

108 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
spring-security-web@5.2.1.RELEASE
5.7.13
3
provectuslabs/kafka-ui:latest8f2ff02d64b0
spring-security-web@6.1.3
6.1.11
3
apache/nifi-registry:1.26.07cdfd8deec92
spring-security-web@5.8.11
5.8.15
2
geoservercloud/geoserver-cloud-rest:1.0-RC399540eef78ad
spring-security-web@5.3.4.RELEASE
5.7.13
2
geoservercloud/geoserver-cloud-wcs:1.0-RC35c254c53a357
spring-security-web@5.3.4.RELEASE
5.7.13
2
geoservercloud/geoserver-cloud-webui:1.0-RC3c687b1cbc891
spring-security-web@5.3.4.RELEASE
5.7.13
2
geoservercloud/geoserver-cloud-wfs:1.0-RC35288f320cf36
spring-security-web@5.3.4.RELEASE
5.7.13
2
geoservercloud/geoserver-cloud-wms:1.0-RC3a30a60ac6cd0
spring-security-web@5.3.4.RELEASE
5.7.13
2
hazelcast/management-center:5.5.2991ddb27c251
spring-security-web@6.3.3
6.3.4
2
hookiesolutions/webhookie:latest0629694246ba
spring-security-web@5.6.1
5.7.13
2
jenkins/jenkins:2.426.1-jdk11b470bcdc4ecd
spring-security-web@5.8.7
5.8.15
2
nacos/nacos-server:v2.1.0dcf04549c6d7
spring-security-web@5.1.12.RELEASE
5.7.13
2
scorpiobroker/scorpio:RegistrySubscriptionManager_2.1.001e11d800459
spring-security-web@5.6.0
5.7.13
2
scorpiobroker/scorpio:eureka-server_2.1.03f05a113a4be
spring-security-web@5.6.0
5.7.13
2
scorpiobroker/scorpio:AtContextServer_2.1.05073ceef2fa0
spring-security-web@5.6.0
5.7.13
2
scorpiobroker/scorpio:gateway_2.1.062dae3dd0eeb
spring-security-web@5.6.0
5.7.13
2
scorpiobroker/scorpio:RegistryManager_2.1.0a2cfcf0947fd
spring-security-web@5.6.0
5.7.13
2
scorpiobroker/scorpio:QueryManager_2.1.0b742a53b2803
spring-security-web@5.6.0
5.7.13
2
scorpiobroker/scorpio:HistoryManager_2.1.0b7fe27a06ff5
spring-security-web@5.6.0
5.7.13
2
scorpiobroker/scorpio:SubscriptionManager_2.1.0e08036670d66
spring-security-web@5.6.0
5.7.13
2
scorpiobroker/scorpio:EntityManager_2.1.0f02e8a429a08
spring-security-web@5.6.0
5.7.13
2
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
spring-security-web@5.5.0
5.7.13
1
andrianrf/backoffice-be:latest6036614803d4
spring-security-web@5.7.8
5.7.13
1
andrianrf/bpjstk-service:latest46abe878d9d8
spring-security-web@5.3.4.RELEASE
5.7.13
1
andrianrf/iso-client:latestba560086ce15
spring-security-web@5.3.4.RELEASE
5.7.13
1
apache/nifi-registry:1.14.0090b7f87ec7f
spring-security-web@5.5.0
5.7.13
1
apache/nifi-registry:1.27.063b8e3e40742
spring-security-web@5.8.13
5.8.15
1
apache/nifi-registry:0.8.0974efa2f21da
spring-security-web@5.2.2.RELEASE
5.7.13
1
apache/ranger:2.7.076c176e8a0e4
spring-security-web@5.7.12
5.7.13
1
apache/shenyu-bootstrap:2.5.11bd5756f6273
spring-security-web@5.6.5
5.7.13
1
apimap/api:v1.8.11ae2b3ab00177
spring-security-web@5.7.4
5.7.13
1
assistiot/tacticle_dashboard:api-lateste4414cb72dc4
spring-security-web@5.7.1
5.7.13
1
atlassian/crowd:5.2.2ebf761c7d437
spring-security-web@5.5.8
5.7.13
1
binhex/arch-nzbhydra2:3.1.0-1-01fb8952921ab6
spring-security-web@5.3.3.RELEASE
5.7.13
1
commerceexperts/smartquery-service:2.2.09e33ad89baf6
spring-security-web@5.7.10
5.7.13
1
dannielkil/book-backend:lateste3b479a55a69
spring-security-web@5.7.3
5.7.13
1
drpcorg/dshackle:0.54.08858fae1859d
spring-security-web@5.5.3
5.7.13
1
eclipseaerios/management-portal-backend:1.2.215fba526a4f8
spring-security-web@6.2.2
6.2.7
1
elastictranscoder/media:627e21dc963ab3858c6b
spring-security-web@5.5.0
5.7.13
1
elastictranscoder/media-storage:f6d861a026208b8c2359
spring-security-web@5.5.0
5.7.13
1
elastictranscoder/transcoder-handler:627e21dc5b75d19e2733
spring-security-web@5.5.0
5.7.13
1
emeraldpay/dshackle:0.14.0126f0ae0b388
spring-security-web@5.5.3
5.7.13
1
emeraldpay/dshackle:0.12ac2a4bc66ab6
spring-security-web@5.5.3
5.7.13
1
fimperato/detected-info-notification:1.2.6-RELEASE6441f6545613
spring-security-web@5.7.5
5.7.13
1
flowable/flowable-rest:7.1.0b7ae287502cd
spring-security-web@6.3.3
6.3.4
1
gdrocha/togglr-backend:1.0.0d5ae64e83d4c
spring-security-web@6.1.5
6.1.11
1
geonetwork/gn-cloud-ogc-api-records-service:4.2.8-020c9bb761f67
spring-security-web@5.3.6.RELEASE
5.7.13
1
geoservercloud/geoserver-cloud-rest:1.0-RC25dc0c93a1710
spring-security-web@5.3.4.RELEASE
5.7.13
1
geoservercloud/geoserver-cloud-wcs:1.0-RC247ae1bdb4bcc
spring-security-web@5.3.4.RELEASE
5.7.13
1
geoservercloud/geoserver-cloud-webui:1.0-RC228c3e5a8c5a3
spring-security-web@5.3.4.RELEASE
5.7.13
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.