1. Home
  2. Vulnerabilities
  3. CVE-2014-0225

CVE-2014-0225

CVSS v3.0 8.8 (High)
88% Progress
CVSS v2.0 6.8 (Medium)
68% Progress
EPSS 0.18 % (56th)
0.18% Progress
Affected Products 2
Advisories 3
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software OVAL Tools, Exploits & PoC Graph Web & Social Timeline

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.

Weaknesses
CWE-611
Improper Restriction of XML External Entity Reference
CVE Status
PUBLISHED
CNA
Dell
Published Date
2017-05-25 17:29:00
(7 years ago)
Updated Date
2022-04-11 17:16:26
(2 years ago)

Affected Products

Pivotal Software

Vmware

Configuration #1

    CPE23 From Up To
  Pivotal Software Spring Framework 3.0.0 cpe:2.3:a:pivotal_software:spring_framework:3.0.0
  Pivotal Software Spring Framework 3.1.0 cpe:2.3:a:pivotal_software:spring_framework:3.1.0
  Pivotal Software Spring Framework 3.2.0 cpe:2.3:a:pivotal_software:spring_framework:3.2.0
  Pivotal Software Spring Framework 4.0.0 cpe:2.3:a:pivotal_software:spring_framework:4.0.0
  Vmware Spring Framework 3.0.1 cpe:2.3:a:vmware:spring_framework:3.0.1
  Vmware Spring Framework 3.0.2 cpe:2.3:a:vmware:spring_framework:3.0.2
  Vmware Spring Framework 3.0.3 cpe:2.3:a:vmware:spring_framework:3.0.3
  Vmware Spring Framework 3.0.4 cpe:2.3:a:vmware:spring_framework:3.0.4
  Vmware Spring Framework 3.0.5 cpe:2.3:a:vmware:spring_framework:3.0.5
  Vmware Spring Framework 3.0.6 cpe:2.3:a:vmware:spring_framework:3.0.6
  Vmware Spring Framework 3.0.7 cpe:2.3:a:vmware:spring_framework:3.0.7
  Vmware Spring Framework 3.1.0 Rc1 cpe:2.3:a:vmware:spring_framework:3.1.0:rc1
  Vmware Spring Framework 3.1.0 Rc2 cpe:2.3:a:vmware:spring_framework:3.1.0:rc2
  Vmware Spring Framework 3.1.1 cpe:2.3:a:vmware:spring_framework:3.1.1
  Vmware Spring Framework 3.1.2 cpe:2.3:a:vmware:spring_framework:3.1.2
  Vmware Spring Framework 3.1.3 cpe:2.3:a:vmware:spring_framework:3.1.3
  Vmware Spring Framework 3.1.4 cpe:2.3:a:vmware:spring_framework:3.1.4
  Vmware Spring Framework 3.2.0 Rc1 cpe:2.3:a:vmware:spring_framework:3.2.0:rc1
  Vmware Spring Framework 3.2.0 Rc2 cpe:2.3:a:vmware:spring_framework:3.2.0:rc2
  Vmware Spring Framework 3.2.0 Rc2-a cpe:2.3:a:vmware:spring_framework:3.2.0:rc2-a
  Vmware Spring Framework 3.2.1 cpe:2.3:a:vmware:spring_framework:3.2.1
  Vmware Spring Framework 3.2.2 cpe:2.3:a:vmware:spring_framework:3.2.2
  Vmware Spring Framework 3.2.3 cpe:2.3:a:vmware:spring_framework:3.2.3
  Vmware Spring Framework 3.2.4 cpe:2.3:a:vmware:spring_framework:3.2.4
  Vmware Spring Framework 3.2.5 cpe:2.3:a:vmware:spring_framework:3.2.5
  Vmware Spring Framework 3.2.6 cpe:2.3:a:vmware:spring_framework:3.2.6
  Vmware Spring Framework 3.2.7 cpe:2.3:a:vmware:spring_framework:3.2.7
  Vmware Spring Framework 3.2.8 cpe:2.3:a:vmware:spring_framework:3.2.8
  Vmware Spring Framework 4.0.0 Rc1 cpe:2.3:a:vmware:spring_framework:4.0.0:rc1
  Vmware Spring Framework 4.0.0 Rc2 cpe:2.3:a:vmware:spring_framework:4.0.0:rc2
  Vmware Spring Framework 4.0.1 cpe:2.3:a:vmware:spring_framework:4.0.1
  Vmware Spring Framework 4.0.2 cpe:2.3:a:vmware:spring_framework:4.0.2
  Vmware Spring Framework 4.0.3 cpe:2.3:a:vmware:spring_framework:4.0.3
  Vmware Spring Framework 4.0.4 cpe:2.3:a:vmware:spring_framework:4.0.4