← All CVEs

CVE-2014-0054

medium · 6.8

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.

6.8
CVSS
91.4%
EPSS (exploit prob.)
100th
EPSS percentile
2014-04-17
Published

AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

CWE-352

Affected products

VendorProductAffected versions
springsourcespring_framework3.0.0
springsourcespring_framework3.0.0
springsourcespring_framework3.0.0
springsourcespring_framework3.0.0
springsourcespring_framework3.0.0
springsourcespring_framework3.0.0
springsourcespring_framework3.0.0
springsourcespring_framework3.0.0
springsourcespring_framework3.0.0.m1
springsourcespring_framework3.0.0.m2
springsourcespring_framework3.0.1
springsourcespring_framework3.0.2
springsourcespring_framework3.0.3
springsourcespring_framework3.0.4
springsourcespring_framework3.0.5
springsourcespring_framework3.2.5
springsourcespring_framework3.2.6
springsourcespring_framework4.0.0
springsourcespring_framework4.0.1
vmwarespring_framework<= 3.2.7
vmwarespring_framework3.0.6
vmwarespring_framework3.0.7
vmwarespring_framework3.1.0
vmwarespring_framework3.1.1
vmwarespring_framework3.1.2
vmwarespring_framework3.1.3
vmwarespring_framework3.1.4
vmwarespring_framework3.2.0
vmwarespring_framework3.2.1
vmwarespring_framework3.2.2
vmwarespring_framework3.2.3
vmwarespring_framework3.2.4
vmwarespring_framework4.0.0
vmwarespring_framework4.0.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-0054