Read the docs
TI-2014-00050 Aliases CVE-2014-0054GHSA-8cmm-qj8g-fcp6

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8…

Priority HIGH 73CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Tampering
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-352.

Summary

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.

Why it matters now

EPSS 0.91354 99th percentileScored 2026-11-07
Fix Partial org.springframework:spring-webmvc (Maven): 3.2.8, 4.0.2Red Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.springframework:spring-webmvc (Maven)before 3.2.83.2.8Patch availableGHSA-8cmm-qj8g-fcp6
—org.springframework:spring-webmvc (Maven)4.0.0 to before 4.0.24.0.2Patch availableGHSA-8cmm-qj8g-fcp6
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.springframework:spring-webmvc (Maven) Vendor— Affected before 3.2.8 Fixed in 3.2.8 Patch available GHSA-8cmm-qj8g-fcp6
  • org.springframework:spring-webmvc (Maven) Vendor— Affected 4.0.0 to before 4.0.2 Fixed in 4.0.2 Patch available GHSA-8cmm-qj8g-fcp6

CPE configurations NVD · 34

CPEVersionsRoleVendor
cpe:2.3:a:springsource:spring_framework:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:m1:*:*:*:*:*:*3.0.0 m1VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:m2:*:*:*:*:*:*3.0.0 m2VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:m3:*:*:*:*:*:*3.0.0 m3VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:m4:*:*:*:*:*:*3.0.0 m4VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:rc1:*:*:*:*:*:*3.0.0 rc1VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:rc2:*:*:*:*:*:*3.0.0 rc2VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:rc3:*:*:*:*:*:*3.0.0 rc3VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0.m1:*:*:*:*:*:*:*3.0.0.m1VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0.m2:*:*:*:*:*:*:*3.0.0.m2VulnerableSpringsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:m1:*:*:*:*:*:* Versions 3.0.0 m1 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:m2:*:*:*:*:*:* Versions 3.0.0 m2 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:m3:*:*:*:*:*:* Versions 3.0.0 m3 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:m4:*:*:*:*:*:* Versions 3.0.0 m4 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:rc1:*:*:*:*:*:* Versions 3.0.0 rc1 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:rc2:*:*:*:*:*:* Versions 3.0.0 rc2 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:rc3:*:*:*:*:*:* Versions 3.0.0 rc3 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0.m1:*:*:*:*:*:*:* Versions 3.0.0.m1 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0.m2:*:*:*:*:*:*:* Versions 3.0.0.m2 Vulnerable ·Springsource
Show 24 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:springsource:spring_framework:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.4:*:*:*:*:*:*:*3.0.4VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.5:*:*:*:*:*:*:*3.0.5VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.2.5:*:*:*:*:*:*:*3.2.5VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.2.6:*:*:*:*:*:*:*3.2.6VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:4.0.0:rc1:*:*:*:*:*:*4.0.0 rc1VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableSpringsource
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*up to 3.2.7VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.0.6:*:*:*:*:*:*:*3.0.6VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.0.7:*:*:*:*:*:*:*3.0.7VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.3:*:*:*:*:*:*:*3.1.3VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.4:*:*:*:*:*:*:*3.1.4VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.2:*:*:*:*:*:*:*3.2.2VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.3:*:*:*:*:*:*:*3.2.3VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.4:*:*:*:*:*:*:*3.2.4VulnerableVMware
cpe:2.3:a:vmware:spring_framework:4.0.0:milestone1:*:*:*:*:*:*4.0.0 milestone1VulnerableVMware
cpe:2.3:a:vmware:spring_framework:4.0.0:milestone2:*:*:*:*:*:*4.0.0 milestone2VulnerableVMware
  • cpe:2.3:a:springsource:spring_framework:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.2.5:*:*:*:*:*:*:* Versions 3.2.5 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.2.6:*:*:*:*:*:*:* Versions 3.2.6 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:4.0.0:rc1:*:*:*:*:*:* Versions 4.0.0 rc1 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Springsource
  • cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions up to 3.2.7 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.0.6:*:*:*:*:*:*:* Versions 3.0.6 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.0.7:*:*:*:*:*:*:* Versions 3.0.7 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.3:*:*:*:*:*:*:* Versions 3.1.3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.4:*:*:*:*:*:*:* Versions 3.1.4 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:4.0.0:milestone1:*:*:*:*:*:* Versions 4.0.0 milestone1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:4.0.0:milestone2:*:*:*:*:*:* Versions 4.0.0 milestone2 Vulnerable ·VMware

Remediation

  • Fix · GHSA-8cmm-qj8g-fcp6 org.springframework:spring-webmvc (Maven) Fixed in 3.2.8 Advisory →
  • Fix · GHSA-8cmm-qj8g-fcp6 org.springframework:spring-webmvc (Maven) Fixed in 4.0.2 Advisory →

Red Hat 2 advisories

  • RHSA-2014:0400 Released 2014-04-14 · Red Hat rating Moderate
    Red Hat JBoss Fuse 6.1.0 update
    • Red Hat JBoss Fuse 6.1
  • RHSA-2014:0401 Released 2014-04-14 · Red Hat rating Moderate
    Red Hat JBoss A-MQ 6.1.0 update
    • Red Hat JBoss A-MQ 6.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Enterprise 1AffectedNo fix planned: Will not fix
Red Hat OpenShift Enterprise 2AffectedNo fix planned: Will not fix
Red Hat JBoss A-MQ 6.1Fixed RHSA-2014:0401
Red Hat JBoss Fuse 6.1Fixed RHSA-2014:0400

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-0054
  2. 2026-10-03 Alias added: GHSA-8cmm-qj8g-fcp6

References

Advisory 3

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences