CVE-2014-1904: XSS
A cross-site scripting flaw was found in the Spring Framework when using Spring MVC. From the original advisory:
"When a programmer does not specify the action on the Spring form, Spring automatically populates the action field with the requested uri. An attacker can use this to inject malicious content into the form."
This issue affects versions 3.0.0 to 3.2.7, and versions 4.0.0 to 4.0.1.
(the fix is present in version 3.2.8; this was incorrect in the gopivotal flaw - chazlett)
External References:
http://www.gopivotal.com/security/cve-2014-1904
Other sources
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/spring mvcto a version that resolves this vulnerability.Fixed in 3.2.8 - Upgrade
Upgrade
redhat/spring mvcto a version that resolves this vulnerability.Fixed in 4.0.2 - Upgrade
Upgrade
maven/org.springframework:spring-webmvcto a version that resolves this vulnerability.Fixed in 4.0.2.RELEASE - Upgrade
Upgrade
maven/org.springframework:spring-webmvcto a version that resolves this vulnerability.Fixed in 3.2.8.RELEASE - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.2.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1904?
CVE-2014-1904 is classified as a medium severity vulnerability due to its potential to allow cross-site scripting attacks.
How do I fix CVE-2014-1904?
To fix CVE-2014-1904, upgrade Spring MVC to version 3.2.8 or 4.0.2.
What systems are affected by CVE-2014-1904?
CVE-2014-1904 affects versions of Spring MVC before version 3.2.8 and 4.0.2.
What type of vulnerability is CVE-2014-1904?
CVE-2014-1904 is a cross-site scripting vulnerability.
Can CVE-2014-1904 be exploited remotely?
Yes, CVE-2014-1904 can be exploited remotely by attackers through crafted URIs.