GHSA-f93f-g33r-8pcp
Improper Restriction of XML External Entity Reference in Spring Framework
At a glance
- Published
- Updated
- CVE
- CVE-2014-0225
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.springframework:spring-webmvc | introduced 4.0.0, fixed 4.0.5 |
| Maven · org.springframework:spring-webmvc | introduced 3.0.0, fixed 3.2.8 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-0225 ADVISORY
- https://github.com/spring-projects/spring-framework/commit/44ee51a6c9c3734b3fcf9a20817117e86047d753 WEB
- https://github.com/spring-projects/spring-framework/commit/8e096aeef55287dc829484996c9330cf755891a1 WEB
- https://github.com/spring-projects/spring-framework/commit/c6503ebbf7c9e21ff022c58706dbac5417b2b5eb WEB
- https://jira.spring.io/browse/SPR-11768 WEB
- https://pivotal.io/security/cve-2014-0225 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |