CVE-2014-0054
published 2014-04-17CVE-2014-0054: The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution…
PriorityP353medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
91.35%
99.8th percentile
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libspring-java | < libspring-java 3.0.6.RELEASE-13 (bookworm) | libspring-java 3.0.6.RELEASE-13 (bookworm) |
| springsource | spring_framework | — | — |
| springsource | spring_framework | — | — |
| springsource | spring_framework | — | — |
| springsource | spring_framework | — | — |
| springsource | spring_framework | — | — |
| springsource | spring_framework | — | — |
| springsource | spring_framework | — | — |
| springsource | spring_framework | — | — |
| springsource | spring_framework | — | — |
| springsource | spring_framework | — | — |
| springsource | spring_framework | — | — |
| springsource | spring_framework | — | — |
| vmware | spring_framework | <= 3.2.7 | — |
| vmware | spring_framework | — | — |
| vmware | spring_framework | — | — |
| vmware | spring_framework | — | — |
| vmware | spring_framework | — | — |
| vmware | spring_framework | — | — |
| vmware | spring_framework | — | — |
| vmware | spring_framework | — | — |
| vmware | spring_framework | — | — |
| vmware | spring_framework | — | — |
| vmware | spring_framework | — | — |
| vmware | spring_framework | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability is in Jaxb2RootElementHttpMessageConverter in Spring MVC, which fails to disable external entity resolution — detect crafted XML payloads containing external entity declarations (XXE) sent to Spring MVC endpoints ↗
- →Affected versions are Spring Framework 3.0.0 through 3.2.8 and 4.0.0 through 4.0.1 — fingerprint deployed Spring Framework version to identify vulnerable instances ↗
- →Attack vector is user-supplied XML processed by Jaxb2RootElementHttpMessageConverter; monitor HTTP requests with XML Content-Type bodies containing DOCTYPE or ENTITY declarations targeting Spring MVC endpoints ↗
- ·This CVE is an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429 — prior mitigations applied for those CVEs may not fully protect against this variant ↗
- ·In Red Hat OpenShift Enterprise 2, only authenticated users have access to ActiveMQ and thus the ability to exploit this Spring issue, reducing the effective attack surface in that environment ↗
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
ghsa6.8MEDIUM
osv6.8MEDIUM
vendor_debian6.8MEDIUM
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429
vendor_redhat·2014-01-31·CVSS 6.8
CVE-2014-0054 [MEDIUM] Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429
Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
Statement: The Red Hat Security Response Team has rated this issue as having Moderate security impact. OpenShift Enterprise 1 is currently in the Production 1 phase of its lifecycle, as such this issue is not currently planned to be addressed in future updates. For additional information, refer to the Sat
Debian
CVE-2014-0054: libspring-java - The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework befor...
vendor_debian·2014·CVSS 6.8
CVE-2014-0054 [MEDIUM] CVE-2014-0054: libspring-java - The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework befor...
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
Scope: local
bookworm: resolved (fixed in 3.0.6.RELEASE-13)
bullseye: resolved (fixed in 3.0.6.RELEASE-13)
forky: resolved (fixed in 3.0.6.RELEASE-13)
sid: resolved (fixed in 3.0.6.RELEASE-13)
trixie: resolved (fixed in 3.0.6.RELEASE-13)
GHSA
Cross-Site Request Forgery in Spring Framework
ghsa·2022-05-13·CVSS 6.8
CVE-2014-0054 [MEDIUM] CWE-352 Cross-Site Request Forgery in Spring Framework
Cross-Site Request Forgery in Spring Framework
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
OSV
Cross-Site Request Forgery in Spring Framework
osv·2022-05-13·CVSS 6.8
CVE-2014-0054 [MEDIUM] Cross-Site Request Forgery in Spring Framework
Cross-Site Request Forgery in Spring Framework
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
OSV
CVE-2014-0054: The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3
osv·2014-04-17·CVSS 6.8
CVE-2014-0054 [MEDIUM] CVE-2014-0054: The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
No detection rules found.
No public exploits indexed.
http://rhn.redhat.com/errata/RHSA-2014-0400.htmlhttp://secunia.com/advisories/57915http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlhttp://www.securityfocus.com/bid/66148https://jira.spring.io/browse/SPR-11376http://rhn.redhat.com/errata/RHSA-2014-0400.htmlhttp://secunia.com/advisories/57915http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlhttp://www.securityfocus.com/bid/66148https://jira.spring.io/browse/SPR-11376
2014-04-17
Published