It was found that the Spring MVC SourceHttpMessageConverter processed user-provided XML, and did not expose any property for disabling entity resolution in the XML. A remote attacker could use this flaw to conduct XML External Entity (XXE) attacks on web sites, and read files in the context of the user running the application server. The patch for this flaw disables external entity processing by default, and provides a configuration directive to re-enable it. This flaw is considered to be the result of an incomplete fix for CVE-2013-4152.

A cross-site scripting flaw was found in the Spring Framework when using Spring MVC. From the original advisory:

"When a programmer does not specify the action on the Spring form, Spring automatically populates the action field with the requested uri. An attacker can use this to inject malicious content into the form."

This issue affects versions 3.0.0 to 3.2.7, and versions 4.0.0 to 4.0.1.

(the fix is present in version 3.2.8; this was incorrect in the gopivotal flaw - chazlett)

External References:

http://www.gopivotal.com/security/cve-2014-1904