CVE-2014-0054
Cross-Site Request Forgery in Spring Framework
CVE-2014-0054 is a medium vulnerability (CVSS 6.8) in Springsource Spring Framework, published March 29, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 91.4%, the 99th percentile. Fixed in org.springframework:spring-webmvc 3.2.8.
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
Exploit likelihood
What each source reports
NVD Score used
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
- Record
CVE-2014-0054- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
- Record
CVE-2014-0054- Updated
- 2026-11-02
EUVDEUVD-2022-3163 No score
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
- Record
EUVD-2022-3163- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8cmm-qj8g-fcp6 No score
Cross-Site Request Forgery in Spring Framework
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
- Record
GHSA-8cmm-qj8g-fcp6- Weakness
- CWE-352
- Updated
- 2026-11-02
OSVCLSA-2025-1760313981 No score
TuxCare security update for org.springframework (25 CVEs)
TuxCare rebuilt 6 org.springframework packages to address 25 CVEs. Fixed in 4.0.0.RELEASE-tuxcare.1.
- Record
CLSA-2025-1760313981- Updated
- 2026-11-02
OSVCLSA-2025-1760313986 No score
TuxCare security update for org.springframework (29 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 29 CVEs. Fixed in 3.1.1.RELEASE-tuxcare.1.
- Record
CLSA-2025-1760313986- Updated
- 2026-11-02
Show 6 moreShow less
OSVCLSA-2026-1784509762 No score
TuxCare security update for org.springframework (11 CVEs)
TuxCare rebuilt 6 org.springframework packages to address 11 CVEs. Fixed in 3.0.5.RELEASE-tuxcare.8.
- Record
CLSA-2026-1784509762- Updated
- 2026-11-02
OSV No score
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
- Record
CVE-2014-0054- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-0054 No score
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
- Record
DEBIAN-CVE-2014-0054- Updated
- 2026-11-02
OSVGHSA-8cmm-qj8g-fcp6 No score
Cross-Site Request Forgery in Spring Framework
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
- Record
GHSA-8cmm-qj8g-fcp6- Weakness
- CWE-352
- Updated
- 2026-11-02
OSVMGASA-2014-0155 No score
Updated springframework packages fix multiple vulnerabilities
Updated springframework packages fix security vulnerabilities:
Jaxb2RootElementHttpMessageConverter in Spring MVC processes external XML entities (CVE-2014-0054).
Spring MVC introduces a cross-site scripting vulnerability if the action on a Spring form is not specified (CVE-2014-1904).
- Record
MGASA-2014-0155- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0054 No score
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
- Record
UBUNTU-CVE-2014-0054- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-webmvcMaven |
before 3.2.8 | 3.2.8 |
org.springframework:spring-webmvcMaven |
4.0.0 up to 4.0.2 | 4.0.2 |
org.springframework:spring-beansTuxCare:Maven |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-coreTuxCare:Maven |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-oxmTuxCare:Maven |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.8, plus listed versions 3.0.5.RELEASE-tuxcare.13.0.5.RELEASE-tuxcare.23.0.5.RELEASE-tuxcare.33.0.5.RELEASE-tuxcare.43.0.5.RELEASE-tuxcare.53.0.5.RELEASE-tuxcare.63.0.5.RELEASE-tuxcare.7 |
3.0.5.RELEASE-tuxcare.8 |
org.springframework:spring-contextTuxCare:Maven |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.8, plus listed versions 3.0.5.RELEASE-tuxcare.13.0.5.RELEASE-tuxcare.23.0.5.RELEASE-tuxcare.33.0.5.RELEASE-tuxcare.43.0.5.RELEASE-tuxcare.53.0.5.RELEASE-tuxcare.63.0.5.RELEASE-tuxcare.7 |
3.0.5.RELEASE-tuxcare.8 |
org.springframework:spring-coreTuxCare:Maven |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.8, plus listed versions 3.0.5.RELEASE-tuxcare.13.0.5.RELEASE-tuxcare.23.0.5.RELEASE-tuxcare.33.0.5.RELEASE-tuxcare.43.0.5.RELEASE-tuxcare.53.0.5.RELEASE-tuxcare.63.0.5.RELEASE-tuxcare.7 |
3.0.5.RELEASE-tuxcare.8 |
org.springframework:spring-expressionTuxCare:Maven |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.8, plus listed versions 3.0.5.RELEASE-tuxcare.13.0.5.RELEASE-tuxcare.23.0.5.RELEASE-tuxcare.33.0.5.RELEASE-tuxcare.43.0.5.RELEASE-tuxcare.53.0.5.RELEASE-tuxcare.63.0.5.RELEASE-tuxcare.7 |
3.0.5.RELEASE-tuxcare.8 |
org.springframework:spring-webTuxCare:Maven |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.8, plus listed versions 3.0.5.RELEASE-tuxcare.13.0.5.RELEASE-tuxcare.23.0.5.RELEASE-tuxcare.33.0.5.RELEASE-tuxcare.43.0.5.RELEASE-tuxcare.53.0.5.RELEASE-tuxcare.63.0.5.RELEASE-tuxcare.7 |
3.0.5.RELEASE-tuxcare.8 |
org.springframework:spring-webmvcTuxCare:Maven |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.8, plus listed versions 3.0.5.RELEASE-tuxcare.13.0.5.RELEASE-tuxcare.23.0.5.RELEASE-tuxcare.33.0.5.RELEASE-tuxcare.43.0.5.RELEASE-tuxcare.53.0.5.RELEASE-tuxcare.63.0.5.RELEASE-tuxcare.7 |
3.0.5.RELEASE-tuxcare.8 |
libspring-javaDebian:12 |
before 3.0.6.RELEASE-13 | 3.0.6.RELEASE-13 |
libspring-javaDebian:13 |
before 3.0.6.RELEASE-13 | 3.0.6.RELEASE-13 |
libspring-javaDebian:14 |
before 3.0.6.RELEASE-13 | 3.0.6.RELEASE-13 |
libspring-javaDebian:7 |
before 3.0.6.RELEASE-6+deb7u3, plus listed versions 3.0.6.RELEASE-63.0.6.RELEASE-6+deb7u13.0.6.RELEASE-6+deb7u2 |
3.0.6.RELEASE-6+deb7u3 |
org.springframework:spring-webmvcMaven |
before 3.2.8, plus listed versions 1.01.0-rc11.0.11.11.1-rc1 Show 45 moreShow less1.1-rc21.1.11.1.21.1.31.1.41.1.51.21.2-rc11.2-rc21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.92.02.0-m12.0-m22.0-m32.0-m42.0-m52.0-rc12.0-rc22.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.52.5.12.5.22.5.32.5.42.5.52.5.62.5.6.SEC012.5.6.SEC022.5.6.SEC033.0.0.RELEASE |
3.2.8 |
org.springframework:spring-webmvcMaven |
4.0.0 up to 4.0.2, plus listed versions 4.0.0.RELEASE4.0.1.RELEASE |
4.0.2 |
springframeworkMageia:3 |
before 3.1.1-21.3.mga3 | 3.1.1-21.3.mga3 |
springframeworkMageia:4 |
before 3.1.4-2.2.mga4 | 3.1.4-2.2.mga4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected | OSV |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/66148
jira.spring.io/browse/SPR-11376
oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
rhn.redhat.com/errata/RHSA-2014-0400.html
secunia.com/advisories/57915
nvd.nist.gov/vuln/detail/CVE-2014-0054
Show 14 moreShow less
github.com/spring-projects/spring-framework/issues/16003
security-tracker.debian.org/tracker/CVE-2014-0054
advisories.mageia.org/MGASA-2014-0155.html
gopivotal.com/security/cve-2014-0054
debian.org/security/2014/dsa-2890
bugs.mageia.org/show_bug.cgi?id=13126
ubuntu.com/security/CVE-2014-0054
cve.org/CVERecord?id=CVE-2014-0054
Left out here: 20 versions. The JSON record has them.