GitHub Advisoryadvisory · Maven

GHSA-f93f-g33r-8pcp Improper Restriction of XML External Entity Reference in Spring Framework

HIGH Published 2022-05-13 Modified 2024-02-27 Official page ↗
Aliases
CVE-2014-0225
Ecosystem
Maven
Packages
org.springframework:spring-webmvc
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2022-07-07

Affected packages

• Maven org.springframework:spring-webmvc: >= 4.0.0, < 4.0.5 → fixed in 4.0.5 • Maven org.springframework:spring-webmvc: >= 3.0.0, < 3.2.8 → fixed in 3.2.8

Description

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.

Related

Alias · CVE (1)

  • CVE-2014-0225 When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References