XML External Entity Processing Vulnerability in Spring Framework
CVE-2014-0225

8.8HIGH

Key Information:

Vendor

Pivotal

Status
Spring Framework
Vendor
CVE Published:
25 May 2017

What is CVE-2014-0225?

The Spring Framework, versions 4.0.0 to 4.0.4 and 3.0.0 to 3.2.8, is susceptible to XML External Entity (XXE) processing attacks. This vulnerability arises due to the default behavior of the framework when handling user-supplied XML documents, as it fails to disable the resolution of URI references in Document Type Definition (DTD) declarations. Attackers may exploit this flaw to gain unauthorized access to sensitive data within the application, potentially leading to data breaches and further system compromise.

Affected Version(s)

Spring Framework 4.0.0 to 4.0.4

Spring Framework 3.0.0 to 3.2.8

Spring Framework Earlier unsupported versions may be affected

References

https://pivotal.io/security/cve-2014-0225
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.