[MAVEN:GHSA-F93F-G33R-8PCP] Improper Restriction of XML External Entity Reference in Spring Framework

Severity High

Affected Packages 2

Fixed Packages 2

CVEs 1

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.

Package	Affected Version
pkg:maven/org.springframework/spring-webmvc	>= 3.0.0, < 3.2.8
pkg:maven/org.springframework/spring-webmvc	>= 4.0.0, < 4.0.5

Package	Fixed Version
pkg:maven/org.springframework/spring-webmvc	= 3.2.8
pkg:maven/org.springframework/spring-webmvc	= 4.0.5

ID

MAVEN:GHSA-F93F-G33R-8PCP

Severity

high

URL

https://github.com/advisories/GHSA-f93f-g33r-8pcp

Published

2022-05-13T01:02:39
(2 years ago)

Modified

2023-01-27T05:02:11
(20 months ago)

Rights

Maven Security Team

Other Advisories

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2014-0225
			https://pivotal.io/security/cve-2014-0225
			https://github.com/spring-projects/spring-framework/commit/8e096aeef55287dc829484996c9330cf755891a1
			https://github.com/spring-projects/spring-framework/commit/c6503ebbf7c9e21ff022c58706dbac5417b2b5eb
			https://jira.spring.io/browse/SPR-11768
			https://github.com/advisories/GHSA-f93f-g33r-8pcp

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/org.springframework/spring-webmvc	org.springframework	spring-webmvc	>= 3.0.0 < 3.2.8
Fixed	pkg:maven/org.springframework/spring-webmvc	org.springframework	spring-webmvc	= 3.2.8
Affected	pkg:maven/org.springframework/spring-webmvc	org.springframework	spring-webmvc	>= 4.0.0 < 4.0.5
Fixed	pkg:maven/org.springframework/spring-webmvc	org.springframework	spring-webmvc	= 4.0.5

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date