CVE-2014-0225: XEE
First published: Thu May 25 2017(Updated: )
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pivotal Software Spring Framework | =3.0.0 | |
| Pivotal Software Spring Framework | =3.1.0 | |
| Pivotal Software Spring Framework | =3.2.0 | |
| Pivotal Software Spring Framework | =4.0.0 | |
| VMware Spring Framework | =3.0.1 | |
| VMware Spring Framework | =3.0.2 | |
| VMware Spring Framework | =3.0.3 | |
| VMware Spring Framework | =3.0.4 | |
| VMware Spring Framework | =3.0.5 | |
| VMware Spring Framework | =3.0.6 | |
| VMware Spring Framework | =3.0.7 | |
| VMware Spring Framework | =3.1.0-rc1 | |
| VMware Spring Framework | =3.1.0-rc2 | |
| VMware Spring Framework | =3.1.1 | |
| VMware Spring Framework | =3.1.2 | |
| VMware Spring Framework | =3.1.3 | |
| VMware Spring Framework | =3.1.4 | |
| VMware Spring Framework | =3.2.0-rc1 | |
| VMware Spring Framework | =3.2.0-rc2 | |
| VMware Spring Framework | =3.2.0-rc2-a | |
| VMware Spring Framework | =3.2.1 | |
| VMware Spring Framework | =3.2.2 | |
| VMware Spring Framework | =3.2.3 | |
| VMware Spring Framework | =3.2.4 | |
| VMware Spring Framework | =3.2.5 | |
| VMware Spring Framework | =3.2.6 | |
| VMware Spring Framework | =3.2.7 | |
| VMware Spring Framework | =3.2.8 | |
| VMware Spring Framework | =4.0.0-rc1 | |
| VMware Spring Framework | =4.0.0-rc2 | |
| VMware Spring Framework | =4.0.1 | |
| VMware Spring Framework | =4.0.2 | |
| VMware Spring Framework | =4.0.3 | |
| VMware Spring Framework | =4.0.4 | |
| maven/org.springframework:spring-webmvc | >=3.0.0<3.2.8 | 3.2.8 |
| maven/org.springframework:spring-webmvc | >=4.0.0<4.0.5 | 4.0.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://pivotal.io/security/cve-2014-0225
- https://nvd.nist.gov/vuln/detail/CVE-2014-0225
- https://github.com/spring-projects/spring-framework/commit/8e096aeef55287dc829484996c9330cf755891a1
- https://github.com/spring-projects/spring-framework/commit/c6503ebbf7c9e21ff022c58706dbac5417b2b5eb
- https://jira.spring.io/browse/SPR-11768
- https://github.com/spring-projects/spring-framework/commit/44ee51a6c9c3734b3fcf9a20817117e86047d753
- https://github.com/advisories/GHSA-f93f-g33r-8pcp (Advisory)
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-f93f-g33r-8pcp
- alias/CVE-2014-0225
- agent/software-canonical-lookup
- agent/references
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/author
- agent/description
- agent/event
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/pivotal software
- canonical/pivotal software spring framework
- version/pivotal software spring framework/3.0.0
- version/pivotal software spring framework/3.1.0
- version/pivotal software spring framework/3.2.0
- version/pivotal software spring framework/4.0.0
- vendor/vmware
- canonical/vmware spring framework
- version/vmware spring framework/3.0.1
- version/vmware spring framework/3.0.2
- version/vmware spring framework/3.0.3
- version/vmware spring framework/3.0.4
- version/vmware spring framework/3.0.5
- version/vmware spring framework/3.0.6
- version/vmware spring framework/3.0.7
- version/vmware spring framework/3.1.0-rc1
- version/vmware spring framework/3.1.0-rc2
- version/vmware spring framework/3.1.1
- version/vmware spring framework/3.1.2
- version/vmware spring framework/3.1.3
- version/vmware spring framework/3.1.4
- version/vmware spring framework/3.2.0-rc1
- version/vmware spring framework/3.2.0-rc2
- version/vmware spring framework/3.2.0-rc2-a
- version/vmware spring framework/3.2.1
- version/vmware spring framework/3.2.2
- version/vmware spring framework/3.2.3
- version/vmware spring framework/3.2.4
- version/vmware spring framework/3.2.5
- version/vmware spring framework/3.2.6
- version/vmware spring framework/3.2.7
- version/vmware spring framework/3.2.8
- version/vmware spring framework/4.0.0-rc1
- version/vmware spring framework/4.0.0-rc2
- version/vmware spring framework/4.0.1
- version/vmware spring framework/4.0.2
- version/vmware spring framework/4.0.3
- version/vmware spring framework/4.0.4
- package-manager/maven