Database Management

Why SolarWinds DPA is not affected by CVE-2024-38808 or CVE-2024-38809

This article explains why SolarWinds Database Performance Monitor (DPA) is not affected by two vulnerabilities in the Spring Framework.

First published date

10/5/2024 12:17 AM

Last published date

10/6/2025 3:38 PM

Overview

In 2024, the National Institute of Standards and Technology (NIST) published the following security bulletins about vulnerabilities in the Spring Framework:

  • CVE-2024-38808 

    In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the application evaluates user-supplied SpEL expressions.

  • CVE-2024-38809 

    Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Affected Spring Framework versions include 6.1.0 - 6.1.11, 6.0.0 - 6.0.22, 5.3.0 - 5.3.37, and older, unsupported versions.

The vulnerabilities described in these CVEs impact numerous software companies.

Product section

Database Performance Analyzer

Cause

CVE-2024-38808 and CVE-2024-38809

Resolution

CVE-2024-38808 applies only to applications that evaluate user-supplied SpEL expressions. DPA does not do this, and the DPA codebase does not include the common classes required to parse these expressions. DPA uses the Spring expression language in XML files to evaluate roles assigned to the user for authorization purposes. Therefore, DPA is not vulnerable to this CVE.

CVE-2024-38809 applies only to applications that parse ETags from "If-Match" or "If-Non-Match" request headers. To enable ETag support in an application, org.springframework.web.filter.ShallowEtagHeaderFilter must be included in the web.xml file. DPA does not use ETags and does not include this filter. Therefore, DPA is not vulnerable to this CVE.