CVE-2014-0225

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.

Score

CVSS 3.0 8.8 High

Status

Modified - security_alert@emc.com

Published

2017-05-25

Last modified

2024-08-06

Weaknesses

CWE-611

Affected products

• Spring Framework (Pivotal)
• Spring Framework (Pivotal Software)
• Spring Framework (Vmware)

References

• https://pivotal.io/security/cve-2014-0225