Unscored severity · published Apr 17, 2014
CVE-2014-0054
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote…
–
CVSS
91.4%
EPSS
No
On KEV
Description
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
Exploitation
Is it being used?
Exploit prediction (EPSS)91.4% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Spring Framework · Springsource
3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +13 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0054
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0054
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0400.html
Vendor Advisory
http://secunia.com/advisories/57915
www.oracle.com
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
www.securityfocus.com
http://www.securityfocus.com/bid/66148
Vendor Advisory
https://jira.spring.io/browse/SPR-11376
More from Spring Framework
–
CVE-2013-7315
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows…
–
CVE-2013-4152
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers…
–
CVE-2011-2730
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags…
–
CVE-2010-1622
SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request…