CVE-2014-0054

Spring Framework < 3.2.8 and 4.0.0-4.0.1 - XML External Entity Injection in Jaxb2RootElementHttpMessageConverter

Title source: llm
STIX 2.1

Description

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/66148
Vendor Advisory x_refsource_confirm
https://jira.spring.io/browse/SPR-11376
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0400.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/57915

Scores

EPSS 0.0255
EPSS Percentile 85.7%

Details

CWE
CWE-352
Status published
Products (27)
org.springframework/spring-webmvc 0 - 3.2.8Maven
springsource/spring_framework 3.0.0 (8 CPE variants)
springsource/spring_framework 3.0.0.m1
springsource/spring_framework 3.0.0.m2
springsource/spring_framework 3.0.1
springsource/spring_framework 3.0.2
springsource/spring_framework 3.0.3
springsource/spring_framework 3.0.4
springsource/spring_framework 3.0.5
springsource/spring_framework 3.2.5
... and 17 more
Published Apr 17, 2014
Tracked Since Feb 18, 2026