{"id":"CVE-2014-0054","aliases":["CLSA-2025-1760313981","CLSA-2025-1760313986","CLSA-2026-1784509762","DEBIAN-CVE-2014-0054","DSA-2890-1","EUVD-2022-3163","GHSA-8cmm-qj8g-fcp6","MGASA-2014-0155","UBUNTU-CVE-2014-0054"],"status":"published","title":"Cross-Site Request Forgery in Spring Framework","description":"The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.91354,"percentile":0.99814,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2014-03-29T00:00:00Z","modified":"2026-11-02T19:45:43Z","fixes":[{"ecosystem":"Maven","package":"org.springframework:spring-webmvc","fixed_in":["3.2.8","4.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libspring-java","fixed_in":["3.0.6.RELEASE-13"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libspring-java","fixed_in":["3.0.6.RELEASE-13"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libspring-java","fixed_in":["3.0.6.RELEASE-13"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.2"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.1"}]}],"versions":["4.0.0.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.1"}]}],"versions":["4.0.0.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.1"}]}],"versions":["4.0.0.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.1"}]}],"versions":["4.0.0.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.1"}]}],"versions":["4.0.0.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.1"}]}],"versions":["4.0.0.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.1"}]}],"versions":["3.1.1.RELEASE"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.1"}]}],"versions":["3.1.1.RELEASE"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.1"}]}],"versions":["3.1.1.RELEASE"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.1"}]}],"versions":["3.1.1.RELEASE"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-oxm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.1"}]}],"versions":["3.1.1.RELEASE"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.1"}]}],"versions":["3.1.1.RELEASE"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.1"}]}],"versions":["3.1.1.RELEASE"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5.RELEASE"},{"fixed":"3.0.5.RELEASE-tuxcare.8"}]}],"versions":["3.0.5.RELEASE","3.0.5.RELEASE-tuxcare.1","3.0.5.RELEASE-tuxcare.2","3.0.5.RELEASE-tuxcare.3","3.0.5.RELEASE-tuxcare.4","3.0.5.RELEASE-tuxcare.5","3.0.5.RELEASE-tuxcare.6","3.0.5.RELEASE-tuxcare.7"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5.RELEASE"},{"fixed":"3.0.5.RELEASE-tuxcare.8"}]}],"versions":["3.0.5.RELEASE","3.0.5.RELEASE-tuxcare.1","3.0.5.RELEASE-tuxcare.2","3.0.5.RELEASE-tuxcare.3","3.0.5.RELEASE-tuxcare.4","3.0.5.RELEASE-tuxcare.5","3.0.5.RELEASE-tuxcare.6","3.0.5.RELEASE-tuxcare.7"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5.RELEASE"},{"fixed":"3.0.5.RELEASE-tuxcare.8"}]}],"versions":["3.0.5.RELEASE","3.0.5.RELEASE-tuxcare.1","3.0.5.RELEASE-tuxcare.2","3.0.5.RELEASE-tuxcare.3","3.0.5.RELEASE-tuxcare.4","3.0.5.RELEASE-tuxcare.5","3.0.5.RELEASE-tuxcare.6","3.0.5.RELEASE-tuxcare.7"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5.RELEASE"},{"fixed":"3.0.5.RELEASE-tuxcare.8"}]}],"versions":["3.0.5.RELEASE","3.0.5.RELEASE-tuxcare.1","3.0.5.RELEASE-tuxcare.2","3.0.5.RELEASE-tuxcare.3","3.0.5.RELEASE-tuxcare.4","3.0.5.RELEASE-tuxcare.5","3.0.5.RELEASE-tuxcare.6","3.0.5.RELEASE-tuxcare.7"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5.RELEASE"},{"fixed":"3.0.5.RELEASE-tuxcare.8"}]}],"versions":["3.0.5.RELEASE","3.0.5.RELEASE-tuxcare.1","3.0.5.RELEASE-tuxcare.2","3.0.5.RELEASE-tuxcare.3","3.0.5.RELEASE-tuxcare.4","3.0.5.RELEASE-tuxcare.5","3.0.5.RELEASE-tuxcare.6","3.0.5.RELEASE-tuxcare.7"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5.RELEASE"},{"fixed":"3.0.5.RELEASE-tuxcare.8"}]}],"versions":["3.0.5.RELEASE","3.0.5.RELEASE-tuxcare.1","3.0.5.RELEASE-tuxcare.2","3.0.5.RELEASE-tuxcare.3","3.0.5.RELEASE-tuxcare.4","3.0.5.RELEASE-tuxcare.5","3.0.5.RELEASE-tuxcare.6","3.0.5.RELEASE-tuxcare.7"],"bundled":11},{"source":"osv","ecosystem":"Debian:12","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6.RELEASE-13"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6.RELEASE-13"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6.RELEASE-13"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6.RELEASE-6+deb7u3"}]}],"versions":["3.0.6.RELEASE-6","3.0.6.RELEASE-6+deb7u1","3.0.6.RELEASE-6+deb7u2"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8"}]}],"versions":["1.0","1.0-rc1","1.0.1","1.1","1.1-rc1","1.1-rc2","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.2","1.2-rc1","1.2-rc2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","2.0","2.0-m1","2.0-m2","2.0-m3","2.0-m4","2.0-m5","2.0-rc1","2.0-rc2","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.5","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.6.SEC01","2.5.6.SEC02","2.5.6.SEC03","3.0.0.RELEASE","3.0.1.RELEASE","3.0.2.RELEASE","3.0.3.RELEASE","3.0.4.RELEASE","3.0.5.RELEASE","3.0.6.RELEASE","3.0.7.RELEASE","3.1.0.RELEASE","3.1.1.RELEASE","3.1.2.RELEASE","3.1.3.RELEASE","3.1.4.RELEASE","3.2.0.RELEASE","3.2.1.RELEASE","3.2.2.RELEASE","3.2.3.RELEASE","3.2.4.RELEASE","3.2.5.RELEASE","3.2.6.RELEASE","3.2.7.RELEASE"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.2"}]}],"versions":["4.0.0.RELEASE","4.0.1.RELEASE"]},{"source":"osv","ecosystem":"Mageia:3","package":"springframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-21.3.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"springframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-2.2.mga4"}]}],"bundled":2}],"products":[{"vendor":"springsource","product":"spring_framework"},{"vendor":"vmware","product":"spring_framework"}],"references":[{"url":"http://www.securityfocus.com/bid/66148","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://jira.spring.io/browse/SPR-11376","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0400.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/57915","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0054","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-framework/issues/16003","tags":["web"]},{"url":"https://github.com/spring-projects/spring-framework/commit/1a8629d40825c073b6863ae2ab748b647b28506a","tags":["web"]},{"url":"https://github.com/spring-projects/spring-framework/commit/1c5cab2a4069ec3239c531d741aeb07a434f521b","tags":["web"]},{"url":"https://github.com/spring-projects/spring-framework/commit/edba32b3093703d5e9ed42b5b8ec23ecc1998398","tags":["web"]},{"url":"https://github.com/spring-projects/spring-framework/commit/fb0683c066e74e9667d6cd8c5fa01f674c68c3be","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8cmm-qj8g-fcp6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0054","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0155.html","tags":["advisory"]},{"url":"http://www.gopivotal.com/security/cve-2014-0054","tags":["web","report"]},{"url":"http://www.gopivotal.com/security/cve-2014-1904","tags":["web"]},{"url":"http://www.debian.org/security/2014/dsa-2890","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0054","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0054","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-0054","description":"The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.","status":"published","published":"2014-04-17T14:00:00Z","modified":"2024-08-06T09:05:38.783Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2022-3163","description":"The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.","status":"published","published":"2014-04-17T14:00:00Z","modified":"2024-08-06T09:05:38Z","updated_at":"2026-11-03T01:57:22.468358Z"}],"ghsa":[{"id":"GHSA-8cmm-qj8g-fcp6","title":"Cross-Site Request Forgery in Spring Framework","description":"The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.","status":"published","published":"2022-05-13T01:02:38Z","modified":"2024-02-27T23:40:01Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:37:38.935144Z"}],"nvd":[{"id":"CVE-2014-0054","description":"The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.","status":"published","published":"2014-04-17T14:55:06.417Z","modified":"2026-06-17T00:02:10.14Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:02:54.082915Z"}],"osv":[{"id":"CLSA-2025-1760313981","title":"TuxCare security update for org.springframework (25 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 25 CVEs. Fixed in 4.0.0.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-11-02T19:45:10.002032675Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1760313986","title":"TuxCare security update for org.springframework (29 CVEs)","description":"TuxCare rebuilt 7 org.springframework packages to address 29 CVEs. Fixed in 3.1.1.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-11-02T19:45:07.855395278Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1784509762","title":"TuxCare security update for org.springframework (11 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 11 CVEs. Fixed in 3.0.5.RELEASE-tuxcare.8.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-11-02T19:45:43.461090164Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CVE-2014-0054","description":"The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.","status":"published","published":"2014-04-17T14:55:06Z","modified":"2026-04-16T06:23:03.356067369Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-0054","description":"The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.","status":"published","published":"2014-04-17T14:55:06.417Z","modified":"2026-10-23T15:47:28.818252941Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2890-1","title":"libspring-java - security update","status":"published","published":"2014-03-29T00:00:00Z","modified":"2026-03-09T01:18:49.514753Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"GHSA-8cmm-qj8g-fcp6","title":"Cross-Site Request Forgery in Spring Framework","description":"The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.","status":"published","published":"2022-05-13T01:02:38Z","modified":"2024-12-04T05:38:04.547455Z","cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"MGASA-2014-0155","title":"Updated springframework packages fix multiple vulnerabilities","description":"Updated springframework packages fix security vulnerabilities:\n\nJaxb2RootElementHttpMessageConverter in Spring MVC processes external XML\nentities (CVE-2014-0054).\n\nSpring MVC introduces a cross-site scripting vulnerability if the action on a\nSpring form is not specified (CVE-2014-1904).\n","status":"published","published":"2014-04-03T01:07:29Z","modified":"2026-04-16T06:24:12.207084403Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2014-0054","description":"The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.","status":"withdrawn","published":"2014-04-17T14:55:00Z","modified":"2025-07-16T07:31:33.948031Z","updated_at":"2026-11-02T15:54:07.855521Z"}]}}