8.8
CVE-2014-0225
- EPSS 0.23%
- Published 25.05.2017 17:29:00
- Last modified 20.04.2025 01:37:25
- Source security_alert@emc.com
- Teams watchlist Login
- Open Login
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
Data is provided by the National Vulnerability Database (NVD)
Pivotal Software ≫ Spring Framework Version3.0.0
Pivotal Software ≫ Spring Framework Version3.1.0
Pivotal Software ≫ Spring Framework Version3.2.0
Pivotal Software ≫ Spring Framework Version4.0.0
VMware ≫ Spring Framework Version3.0.1
VMware ≫ Spring Framework Version3.0.2
VMware ≫ Spring Framework Version3.0.3
VMware ≫ Spring Framework Version3.0.4
VMware ≫ Spring Framework Version3.0.5
VMware ≫ Spring Framework Version3.0.6
VMware ≫ Spring Framework Version3.0.7
VMware ≫ Spring Framework Version3.1.0 Updaterc1
VMware ≫ Spring Framework Version3.1.0 Updaterc2
VMware ≫ Spring Framework Version3.1.1
VMware ≫ Spring Framework Version3.1.2
VMware ≫ Spring Framework Version3.1.3
VMware ≫ Spring Framework Version3.1.4
VMware ≫ Spring Framework Version3.2.0 Updaterc1
VMware ≫ Spring Framework Version3.2.0 Updaterc2
VMware ≫ Spring Framework Version3.2.0 Updaterc2-a
VMware ≫ Spring Framework Version3.2.1
VMware ≫ Spring Framework Version3.2.2
VMware ≫ Spring Framework Version3.2.3
VMware ≫ Spring Framework Version3.2.4
VMware ≫ Spring Framework Version3.2.5
VMware ≫ Spring Framework Version3.2.6
VMware ≫ Spring Framework Version3.2.7
VMware ≫ Spring Framework Version3.2.8
VMware ≫ Spring Framework Version4.0.0 Updaterc1
VMware ≫ Spring Framework Version4.0.0 Updaterc2
VMware ≫ Spring Framework Version4.0.1
VMware ≫ Spring Framework Version4.0.2
VMware ≫ Spring Framework Version4.0.3
VMware ≫ Spring Framework Version4.0.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.23% | 0.459 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-611 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.