CVE-2014-0054
NoneCVSS
—
EPSS
91.4%
Published
Apr 17, 2014
CISA due date
—
The record
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.springframework:spring-webmvc | 0 | 3.2.8 |
| Maven | org.springframework:spring-webmvc | 4.0.0 | 4.0.2 |
| Debian:11 | libspring-java | 0 | 3.0.6.RELEASE-13 |
| Debian:12 | libspring-java | 0 | 3.0.6.RELEASE-13 |
| Debian:13 | libspring-java | 0 | 3.0.6.RELEASE-13 |
| Debian:7 | libspring-java | 0 | 3.0.6.RELEASE-6+deb7u3 |
| Mageia:3 | springframework | 0 | 3.1.1-21.3.mga3 |
| Mageia:4 | springframework | 0 | 3.1.4-2.2.mga4 |
| Ubuntu:14.04:LTS | libspring-java | 0 | 3.0.6.RELEASE-13 |
| maven | org.springframework/spring-webmvc | 3.2-alpha0 | No fix |
| maven | org.springframework/spring-webmvc | 4.0-alpha0 | No fix |
Related vulnerabilities
- CVE-2025-41242 Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability”… Also affects org.springframework:spring-webmvc
- CVE-2024-38819 Applications serving static resources through the functional web frameworks WebMvc.fn or… Also affects org.springframework:spring-webmvc
- CVE-2024-38828 Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable… Also affects org.springframework:spring-webmvc
- CVE-2024-38816 Applications serving static resources through the functional web frameworks WebMvc.fn or… Also affects org.springframework:spring-webmvc
- CVE-2023-34053 In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide… Also affects org.springframework:spring-webmvc
- CVE-2014-0225 When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0… Also affects org.springframework:spring-webmvc
- CVE-2025-41249 The Spring Framework annotation detection mechanism may not correctly resolve annotations… Also affects libspring-java
- CVE-2025-22233 CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured… Also affects libspring-java