CVE-2014-0225
High
Description
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Pivotal Software Spring Framework
PublishedMay 25, 2017
First seenMay 25, 2017
How to fix
Update
- org.springframework:spring-webmvc4.0.5, 3.2.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pivotal_software spring_framework | 3.0.0, 3.1.0, 3.2.0, 4.0.0 | — |
| vmware spring_framework | 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4 | — |
| org.springframework:spring-webmvcMaven | 4.0.0 ≤ v < 4.0.5, 3.0.0 ≤ v < 3.2.8 | 4.0.5, 3.2.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.