A cross-site scripting flaw was found in the Spring Framework when using Spring MVC. From the original advisory:

"When a programmer does not specify the action on the Spring form, Spring automatically populates the action field with the requested uri. An attacker can use this to inject malicious content into the form."

This issue affects versions 3.0.0 to 3.2.7, and versions 4.0.0 to 4.0.1.

(the fix is present in version 3.2.8; this was incorrect in the gopivotal flaw - chazlett)

External References:

http://www.gopivotal.com/security/cve-2014-1904