CVE-2014-0054

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
VendorProductVersion
springsourcespring_framework
3.0.0
springsourcespring_framework
3.0.0:m1
springsourcespring_framework
3.0.0:m2
springsourcespring_framework
3.0.0:m3
springsourcespring_framework
3.0.0:m4
springsourcespring_framework
3.0.0:rc1
springsourcespring_framework
3.0.0:rc2
springsourcespring_framework
3.0.0:rc3
springsourcespring_framework
3.0.0.m1:m1
springsourcespring_framework
3.0.0.m2:m2
springsourcespring_framework
3.0.1
springsourcespring_framework
3.0.2
springsourcespring_framework
3.0.3
springsourcespring_framework
3.0.4
springsourcespring_framework
3.0.5
springsourcespring_framework
3.2.5
springsourcespring_framework
3.2.6
springsourcespring_framework
4.0.0:rc1
springsourcespring_framework
4.0.1
vmwarespring_framework
𝑥
≤ 3.2.7
vmwarespring_framework
3.0.6
vmwarespring_framework
3.0.7
vmwarespring_framework
3.1.0
vmwarespring_framework
3.1.1
vmwarespring_framework
3.1.2
vmwarespring_framework
3.1.3
vmwarespring_framework
3.1.4
vmwarespring_framework
3.2.0
vmwarespring_framework
3.2.1
vmwarespring_framework
3.2.2
vmwarespring_framework
3.2.3
vmwarespring_framework
3.2.4
vmwarespring_framework
4.0.0:milestone1
vmwarespring_framework
4.0.0:milestone2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libspring-java
bullseye
4.3.30-1
fixed
sid
4.3.30-2
fixed
trixie
4.3.30-2
fixed
bookworm
4.3.30-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libspring-java
zesty
not-affected
yakkety
not-affected
xenial
not-affected
wily
not-affected
vivid
not-affected
utopic
not-affected
trusty
not-affected
saucy
ignored
quantal
ignored
precise
ignored
lucid
dne
Common Weakness Enumeration
References
http://rhn.redhat.com/errata/RHSA-2014-0400.html
http://secunia.com/advisories/57915
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.securityfocus.com/bid/66148
https://jira.spring.io/browse/SPR-11376
http://rhn.redhat.com/errata/RHSA-2014-0400.html
http://secunia.com/advisories/57915
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.securityfocus.com/bid/66148
https://jira.spring.io/browse/SPR-11376