PatchTheCVECVE-2024-6680: A vulnerability classified as critical was found in witmy my-springsecurity-plus up to 2024-07-04
CVE-2024-6680 is a medium-severity flaw (CVSS 6.3) affecting my-springsecurity-plus. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability classified as critical was found in witmy my-springsecurity-plus up to 2024-07-04. Affected by this vulnerability is an unknown functionality of the file /api/dept/build. The manipulation of the argument params.dataScope leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271153 was assigned to this vulnerability.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 59%) |
| CISA exploited list | No |
| Weakness | CWE-89 |
| Published | 2024-07-11 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-6680?
my-springsecurity-plus: upgrade to newer than 2024-07-04. Exact commands for each OS are on this page.
Is CVE-2024-6680 being exploited?
CVE-2024-6680 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-6680 affect?
CVE-2024-6680 affects my-springsecurity-plus. Severity is medium (CVSS 6.3). A vulnerability classified as critical was found in witmy my-springsecurity-plus up to 2024-07-04. Affected by this vulnerability is an unknown functionality of the file /api/dept/build. The manipulation of the argument params.dataScope lea
How urgent is CVE-2024-6680?
Priority 32/100. No elevated risk signals yet.
Related CVEs
- CVE-2024-6681 MEDIUM 6.3 UPGRADE A vulnerability, which was classified as critical, has been found in witmy my-springsecurity-plus up to 2024-0
- CVE-2024-6679 MEDIUM 6.3 UPGRADE A vulnerability classified as critical has been found in witmy my-springsecurity-plus up to 2024-07-04
- CVE-2024-6676 MEDIUM 6.3 UPGRADE A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical
- CVE-2024-40542 CRITICAL 9.8 UPGRADE my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the data
- CVE-2024-40541 CRITICAL 9.8 UPGRADE my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the data