The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: redhat
Published: 2014-04-17T14:00:00
Updated: 2024-08-06T09:05:38.783Z
Reserved: 2013-12-03T00:00:00
Link: CVE-2014-0054
Vulnrichment
No data.
NVD
Status : Modified
Published: 2014-04-17T14:55:06.417
Modified: 2024-11-21T02:01:15.597
Link: CVE-2014-0054
Redhat