Cross-Site Scripting Vulnerability in Spring Framework by Pivotal
CVE-2014-1904

Currently unrated

Key Information:

Vendor: Pivotal Software
Status: Spring Framework
Vendor: CVE Published:; 20 March 2014

🔔 Create Pivotal Software Vulnerability Alert

What is CVE-2014-1904?

A Cross-Site Scripting (XSS) vulnerability exists in the Spring Framework, specifically in web/servlet/tags/form/FormTag.java. This vulnerability allows remote attackers to insert arbitrary web scripts or HTML through crafted requests via the URI in default action scenarios. This weakness affects versions prior to Spring Framework 3.2.8 and 4.0.2, posing a significant risk to applications utilizing these affected versions.

References

http://www.gopivotal.com/security/cve-2014-1904

x_refsource_CONFIRM

http://www.securityfocus.com/bid/66137

vdb-entryx_refsource_BID

https://jira.springsource.org/browse/SPR-11426

x_refsource_CONFIRM

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Mar 20, 2014
Vulnerability Reserved
Feb 7, 2014

CVE-2014-1904 Data

JSON