CVE-2014-0225

Опубликовано: 25 мая 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.

Ссылки

https://pivotal.io/security/cve-2014-0225
Vendor Advisory
https://pivotal.io/security/cve-2014-0225
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:pivotal_software:spring_framework:3.0.0:*:*:*:*:*:*:*

cpe:2.3:a:pivotal_software:spring_framework:3.1.0:*:*:*:*:*:*:*

cpe:2.3:a:pivotal_software:spring_framework:3.2.0:*:*:*:*:*:*:*

cpe:2.3:a:pivotal_software:spring_framework:4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.0.1:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.0.2:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.0.3:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.0.4:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.0.5:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.0.6:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.0.7:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.1.0:rc1:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.1.0:rc2:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.1.1:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.1.2:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.1.3:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.1.4:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.2.0:rc1:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.2.0:rc2:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.2.0:rc2-a:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.2.1:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.2.2:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.2.3:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.2.4:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.2.5:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.2.6:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.2.7:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.2.8:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:4.0.0:rc1:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:4.0.0:rc2:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:4.0.4:*:*:*:*:*:*:*

EPSS

Процентиль: 46%

0.00236

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-611

Связанные уязвимости

CVE-2014-0225

CVSS3: 8.8

ubuntu

почти 9 лет назад

CVE-2014-0225

redhat

почти 12 лет назад

CVE-2014-0225

CVSS3: 8.8

debian

почти 9 лет назад

When processing user provided XML documents, the Spring Framework 4.0. ...

GHSA-f93f-g33r-8pcp

CVSS3: 8.8

github

почти 4 года назад

Improper Restriction of XML External Entity Reference in Spring Framework

EPSS

Процентиль: 46%

0.00236

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-611