The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: redhat
Published: 2014-04-17T14:00:00
Updated: 2018-04-19T01:57:01
Reserved: 2013-12-03T00:00:00
Link: CVE-2014-0054
JSON object: View
NVD Information
Status : Modified
Published: 2014-04-17T14:55:06.417
Modified: 2022-04-11T17:36:29.937
Link: CVE-2014-0054
JSON object: View
Redhat Information
No data.
CWE