It was found that the Spring MVC SourceHttpMessageConverter processed user-provided XML, and did not expose any property for disabling entity resolution in the XML. A remote attacker could use this flaw to conduct XML External Entity (XXE) attacks on web sites, and read files in the context of the user running the application server. The patch for this flaw disables external entity processing by default, and provides a configuration directive to re-enable it. This flaw is considered to be the result of an incomplete fix for CVE-2013-4152.