CVE-2014-1904
published 2014-03-20CVE-2014-1904: Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2…
PriorityP420medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
3.35%
87.3th percentile
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libspring-java | < libspring-java 3.0.6.RELEASE-13 (bookworm) | libspring-java 3.0.6.RELEASE-13 (bookworm) |
| pivotal_software | spring_framework | >= 3.0.0 < 3.2.8 | 3.2.8 |
| pivotal_software | spring_framework | >= 4.0.0 < 4.0.2 | 4.0.2 |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Framework: cross-site scripting flaw when using Spring MVC
vendor_redhat·2014-02-13·CVSS 4.3
CVE-2014-1904 [MEDIUM] CWE-79 Framework: cross-site scripting flaw when using Spring MVC
Framework: cross-site scripting flaw when using Spring MVC
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Statement: The Red Hat Security Response Team has rated this issue as having Moderate security impact. OpenShift Enterprise 1 is currently in the Production 1 phase of its lifecycle, as such this issue is not currently planned to be addressed in future updates. For additional information, refer to the Satellite Life Cycle: https://access.redhat.com/site/support/policy/updates/openshift page.
Fuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Im
Debian
CVE-2014-1904: libspring-java - Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java i...
vendor_debian·2014·CVSS 4.3
CVE-2014-1904 [MEDIUM] CVE-2014-1904: libspring-java - Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java i...
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Scope: local
bookworm: resolved (fixed in 3.0.6.RELEASE-13)
bullseye: resolved (fixed in 3.0.6.RELEASE-13)
forky: resolved (fixed in 3.0.6.RELEASE-13)
sid: resolved (fixed in 3.0.6.RELEASE-13)
trixie: resolved (fixed in 3.0.6.RELEASE-13)
GHSA
Improper Neutralization of Input During Web Page Generation in Spring Framework
ghsa·2022-05-14
CVE-2014-1904 [MEDIUM] CWE-79 Improper Neutralization of Input During Web Page Generation in Spring Framework
Improper Neutralization of Input During Web Page Generation in Spring Framework
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
OSV
Improper Neutralization of Input During Web Page Generation in Spring Framework
osv·2022-05-14
CVE-2014-1904 [MEDIUM] Improper Neutralization of Input During Web Page Generation in Spring Framework
Improper Neutralization of Input During Web Page Generation in Spring Framework
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
OSV
CVE-2014-1904: Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag
osv·2014-03-20·CVSS 4.3
CVE-2014-1904 [MEDIUM] CVE-2014-1904: Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
No detection rules found.
No public exploits indexed.
http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txthttp://rhn.redhat.com/errata/RHSA-2014-0400.htmlhttp://seclists.org/fulldisclosure/2014/Mar/101http://secunia.com/advisories/57915http://www.gopivotal.com/security/cve-2014-1904http://www.securityfocus.com/archive/1/531422/100/0/threadedhttp://www.securityfocus.com/bid/66137https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485https://jira.springsource.org/browse/SPR-11426http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txthttp://rhn.redhat.com/errata/RHSA-2014-0400.htmlhttp://seclists.org/fulldisclosure/2014/Mar/101http://secunia.com/advisories/57915http://www.gopivotal.com/security/cve-2014-1904http://www.securityfocus.com/archive/1/531422/100/0/threadedhttp://www.securityfocus.com/bid/66137https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485https://jira.springsource.org/browse/SPR-11426
2014-03-20
Published