← CVE Intelligence

CVE-2014-0225

Pivotal / Spring Framework PUBLISHED

Description (CNA)

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.

Affected (CNA)

Vendor / productVersions
Pivotal / Spring Frameworkaffected 4.0.0 to 4.0.4; affected 3.0.0 to 3.2.8; affected Earlier unsupported versions may be affected

CWE

No CWE identifiers supplied.

References

ADP enrichment

CVE

No English description supplied.