CVE-2014-1904
Improper Neutralization of Input During Web Page Generation in Spring Framework
CVE-2014-1904 is a medium vulnerability (CVSS 4.3) in Pivotal Software Spring Framework, published March 20, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.90%, the 94th percentile. Fixed in org.springframework:spring-webmvc 3.2.8.RELEASE.
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
- Record
CVE-2014-1904- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
- Record
CVE-2014-1904- Updated
- 2026-11-02
EUVDEUVD-2022-3757 No score
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
- Record
EUVD-2022-3757- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ff7p-jqjm-v66h No score
Improper Neutralization of Input During Web Page Generation in Spring Framework
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
- Record
GHSA-ff7p-jqjm-v66h- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVCLSA-2025-1760313981 No score
TuxCare security update for org.springframework (25 CVEs)
TuxCare rebuilt 6 org.springframework packages to address 25 CVEs. Fixed in 4.0.0.RELEASE-tuxcare.1.
- Record
CLSA-2025-1760313981- Updated
- 2026-11-02
OSVCLSA-2025-1760313986 No score
TuxCare security update for org.springframework (29 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 29 CVEs. Fixed in 3.1.1.RELEASE-tuxcare.1.
- Record
CLSA-2025-1760313986- Updated
- 2026-11-02
Show 5 moreShow less
OSV No score
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
- Record
CVE-2014-1904- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-1904 No score
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
- Record
DEBIAN-CVE-2014-1904- Updated
- 2026-11-02
OSVGHSA-ff7p-jqjm-v66h No score
Improper Neutralization of Input During Web Page Generation in Spring Framework
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
- Record
GHSA-ff7p-jqjm-v66h- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVMGASA-2014-0155 No score
Updated springframework packages fix multiple vulnerabilities
Updated springframework packages fix security vulnerabilities:
Jaxb2RootElementHttpMessageConverter in Spring MVC processes external XML entities (CVE-2014-0054).
Spring MVC introduces a cross-site scripting vulnerability if the action on a Spring form is not specified (CVE-2014-1904).
- Record
MGASA-2014-0155- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-1904 No score
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
- Record
UBUNTU-CVE-2014-1904- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-webmvcMaven |
3.0.0 to 3.2.7.RELEASE | 3.2.8.RELEASE |
org.springframework:spring-webmvcMaven |
4.0.0 to 4.0.1.RELEASE | 4.0.2.RELEASE |
org.springframework:spring-beansTuxCare:Maven |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-coreTuxCare:Maven |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-oxmTuxCare:Maven |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
libspring-javaDebian:12 |
before 3.0.6.RELEASE-13 | 3.0.6.RELEASE-13 |
libspring-javaDebian:13 |
before 3.0.6.RELEASE-13 | 3.0.6.RELEASE-13 |
libspring-javaDebian:14 |
before 3.0.6.RELEASE-13 | 3.0.6.RELEASE-13 |
libspring-javaDebian:7 |
before 3.0.6.RELEASE-6+deb7u3, plus listed versions 3.0.6.RELEASE-63.0.6.RELEASE-6+deb7u13.0.6.RELEASE-6+deb7u2 |
3.0.6.RELEASE-6+deb7u3 |
org.springframework:spring-webmvcMaven |
3.0.0 up to 3.2.8.RELEASE, plus listed versions 3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE Show 16 moreShow less3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE |
3.2.8.RELEASE |
org.springframework:spring-webmvcMaven |
4.0.0 up to 4.0.2.RELEASE, plus listed versions 4.0.0.RELEASE4.0.1.RELEASE |
4.0.2.RELEASE |
springframeworkMageia:3 |
before 3.1.1-21.3.mga3 | 3.1.1-21.3.mga3 |
springframeworkMageia:4 |
before 3.1.4-2.2.mga4 | 3.1.4-2.2.mga4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected | OSV |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
gopivotal.com/security/cve-2014-1904
securityfocus.com/bid/66137
jira.springsource.org/browse/SPR-11426
github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485
rhn.redhat.com/errata/RHSA-2014-0400.html
Show 14 moreShow less
secunia.com/advisories/57915
docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt
seclists.org/fulldisclosure/2014/Mar/101
nvd.nist.gov/vuln/detail/CVE-2014-1904
security-tracker.debian.org/tracker/CVE-2014-1904
advisories.mageia.org/MGASA-2014-0155.html
debian.org/security/2014/dsa-2890
bugs.mageia.org/show_bug.cgi?id=13126
ubuntu.com/security/CVE-2014-1904
cve.org/CVERecord?id=CVE-2014-1904