PatchTheCVECVE-2024-6676: A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical
CVE-2024-6676 is a medium-severity flaw (CVSS 6.3) affecting my-springsecurity-plus. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/user. The manipulation of the argument params.dataScope leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffe
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 61%) |
| CISA exploited list | No |
| Weakness | CWE-89 |
| Published | 2024-07-11 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-6676?
my-springsecurity-plus: upgrade to newer than 2024-07-03. Exact commands for each OS are on this page.
Is CVE-2024-6676 being exploited?
CVE-2024-6676 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-6676 affect?
CVE-2024-6676 affects my-springsecurity-plus. Severity is medium (CVSS 6.3). A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/user. The manipulation of the argument params.dataScope
How urgent is CVE-2024-6676?
Priority 32/100. No elevated risk signals yet.
Related CVEs
- CVE-2024-6681 MEDIUM 6.3 UPGRADE A vulnerability, which was classified as critical, has been found in witmy my-springsecurity-plus up to 2024-0
- CVE-2024-6680 MEDIUM 6.3 UPGRADE A vulnerability classified as critical was found in witmy my-springsecurity-plus up to 2024-07-04
- CVE-2024-6679 MEDIUM 6.3 UPGRADE A vulnerability classified as critical has been found in witmy my-springsecurity-plus up to 2024-07-04
- CVE-2024-40542 CRITICAL 9.8 UPGRADE my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the data
- CVE-2024-40541 CRITICAL 9.8 UPGRADE my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the data