Lucene search
GitHub Advisory DatabaseGHSA-F93F-G33R-8PCPHistoryMay 13, 2022 - 1:02 a.m.
Improper Restriction of XML External Entity Reference in Spring Framework
2022-05-1301:02:39
CWE-611
GitHub Advisory Database
github.com
8
0.002 Low
EPSS
Percentile
55.1%
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.springframework:spring-webmvc | lt | 3.2.8 | |
| org.springframework:spring-webmvc | lt | 4.0.5 |
References
github.com/advisories/GHSA-f93f-g33r-8pcp
github.com/spring-projects/spring-framework/commit/44ee51a6c9c3734b3fcf9a20817117e86047d753
github.com/spring-projects/spring-framework/commit/8e096aeef55287dc829484996c9330cf755891a1
github.com/spring-projects/spring-framework/commit/c6503ebbf7c9e21ff022c58706dbac5417b2b5eb
jira.spring.io/browse/SPR-11768
nvd.nist.gov/vuln/detail/CVE-2014-0225
pivotal.io/security/cve-2014-0225
Related
nessus
nessus
Fedora 20 : springframework-3.1.4-3.fc20 (2015-6862)
2015-05-11 00:00:00
Ubuntu 16.04 ESM : Spring Framework vulnerabilities (USN-4774-1)
2023-10-20 00:00:00
cvelist
cvelist
CVE-2014-0225
2017-05-25 17:00:00
cve
cve
CVE-2014-0225
2017-05-25 17:29:00
osv
osv
Improper Restriction of XML External Entity Reference in Spring Framework
2022-05-13 01:02:39
libspring-java vulnerabilities
2021-03-17 17:02:03
ubuntucve
ubuntucve
CVE-2014-0225
2017-05-25 00:00:00
openvas
openvas
Mageia: Security Advisory (MGASA-2015-0211)
2022-01-28 00:00:00
Fedora Update for springframework FEDORA-2015-6862
2015-05-09 00:00:00
Ubuntu: Security Advisory (USN-4774-1)
2023-01-27 00:00:00
fedora
fedora
[SECURITY] Fedora 20 Update: springframework-3.1.4-3.fc20
2015-05-08 07:40:18
prion
prion
Default configuration
2017-05-25 17:29:00
debiancve
debiancve
CVE-2014-0225
2017-05-25 17:29:00
mageia
mageia
Updated springframework packages fix CVE-2014-0225
2015-05-11 23:10:38
ubuntu
ubuntu
Spring Framework vulnerabilities
2021-03-17 00:00:00
redhat
redhat
(RHSA-2014:1351) Important: Red Hat JBoss Fuse/A-MQ 6.1.0 security update
2014-10-01 18:06:06
