Read the docs
TI-2014-00218 Aliases CVE-2014-0225GHSA-f93f-g33r-8pcp

XML external entity injection in Pivotal Spring Framework

Priority MEDIUM 41CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 6 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.

Why it matters now

EPSS 0.01475 73rd percentileScored 2026-11-07
Fix Partial org.springframework:spring-webmvc (Maven): 4.0.5, 3.2.8Red Hat: 1 advisoryRed Hat: 2 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PivotalSpring Framework4.0.0 to 4.0.4; 3.0.0 to 3.2.8; Earlier unsupported versions may be affected—No fix listedCNA
—org.springframework:spring-webmvc (Maven)4.0.0 to before 4.0.54.0.5Patch availableGHSA-f93f-g33r-8pcp
—org.springframework:spring-webmvc (Maven)3.0.0 to before 3.2.83.2.8Patch availableGHSA-f93f-g33r-8pcp
  • Spring Framework VendorPivotal Affected 4.0.0 to 4.0.4; 3.0.0 to 3.2.8; Earlier unsupported versions may be affected Fixed in — No fix listed CNA
  • org.springframework:spring-webmvc (Maven) Vendor— Affected 4.0.0 to before 4.0.5 Fixed in 4.0.5 Patch available GHSA-f93f-g33r-8pcp
  • org.springframework:spring-webmvc (Maven) Vendor— Affected 3.0.0 to before 3.2.8 Fixed in 3.2.8 Patch available GHSA-f93f-g33r-8pcp

CPE configurations NVD · 34

CPEVersionsRoleVendor
cpe:2.3:a:pivotal_software:spring_framework:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:spring_framework:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:spring_framework:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:spring_framework:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableSpring by Pivotal
cpe:2.3:a:vmware:spring_framework:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.0.4:*:*:*:*:*:*:*3.0.4VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.0.5:*:*:*:*:*:*:*3.0.5VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.0.6:*:*:*:*:*:*:*3.0.6VulnerableVMware
  • cpe:2.3:a:pivotal_software:spring_framework:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:spring_framework:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:spring_framework:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:spring_framework:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:vmware:spring_framework:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.0.6:*:*:*:*:*:*:* Versions 3.0.6 Vulnerable ·VMware
Show 24 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_framework:3.0.7:*:*:*:*:*:*:*3.0.7VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.0:rc1:*:*:*:*:*:*3.1.0 rc1VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.0:rc2:*:*:*:*:*:*3.1.0 rc2VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.3:*:*:*:*:*:*:*3.1.3VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.4:*:*:*:*:*:*:*3.1.4VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.0:rc1:*:*:*:*:*:*3.2.0 rc1VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.0:rc2:*:*:*:*:*:*3.2.0 rc2VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.0:rc2-a:*:*:*:*:*:*3.2.0 rc2-aVulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.2:*:*:*:*:*:*:*3.2.2VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.3:*:*:*:*:*:*:*3.2.3VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.4:*:*:*:*:*:*:*3.2.4VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.5:*:*:*:*:*:*:*3.2.5VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.6:*:*:*:*:*:*:*3.2.6VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.7:*:*:*:*:*:*:*3.2.7VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.8:*:*:*:*:*:*:*3.2.8VulnerableVMware
cpe:2.3:a:vmware:spring_framework:4.0.0:rc1:*:*:*:*:*:*4.0.0 rc1VulnerableVMware
cpe:2.3:a:vmware:spring_framework:4.0.0:rc2:*:*:*:*:*:*4.0.0 rc2VulnerableVMware
cpe:2.3:a:vmware:spring_framework:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableVMware
cpe:2.3:a:vmware:spring_framework:4.0.2:*:*:*:*:*:*:*4.0.2VulnerableVMware
cpe:2.3:a:vmware:spring_framework:4.0.3:*:*:*:*:*:*:*4.0.3VulnerableVMware
cpe:2.3:a:vmware:spring_framework:4.0.4:*:*:*:*:*:*:*4.0.4VulnerableVMware
  • cpe:2.3:a:vmware:spring_framework:3.0.7:*:*:*:*:*:*:* Versions 3.0.7 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.0:rc1:*:*:*:*:*:* Versions 3.1.0 rc1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.0:rc2:*:*:*:*:*:* Versions 3.1.0 rc2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.3:*:*:*:*:*:*:* Versions 3.1.3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.4:*:*:*:*:*:*:* Versions 3.1.4 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.0:rc1:*:*:*:*:*:* Versions 3.2.0 rc1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.0:rc2:*:*:*:*:*:* Versions 3.2.0 rc2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.0:rc2-a:*:*:*:*:*:* Versions 3.2.0 rc2-a Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.5:*:*:*:*:*:*:* Versions 3.2.5 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.6:*:*:*:*:*:*:* Versions 3.2.6 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.7:*:*:*:*:*:*:* Versions 3.2.7 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.8:*:*:*:*:*:*:* Versions 3.2.8 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:4.0.0:rc1:*:*:*:*:*:* Versions 4.0.0 rc1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:4.0.0:rc2:*:*:*:*:*:* Versions 4.0.0 rc2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:4.0.3:*:*:*:*:*:*:* Versions 4.0.3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:4.0.4:*:*:*:*:*:*:* Versions 4.0.4 Vulnerable ·VMware

Remediation

  • Fix · GHSA-f93f-g33r-8pcp org.springframework:spring-webmvc (Maven) Fixed in 4.0.5 Advisory →
  • Fix · GHSA-f93f-g33r-8pcp org.springframework:spring-webmvc (Maven) Fixed in 3.2.8 Advisory →

Red Hat 1 advisory

  • RHSA-2014:1351 Released 2014-10-01 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.1.0 security update
    • Red Hat JBoss A-MQ 6.1
    • Red Hat JBoss Fuse 6.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Enterprise 1AffectedNo fix planned: Will not fix
Red Hat Enterprise Virtualization 3AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Will not fix
Red Hat JBoss Portal 5AffectedNo fix planned: Will not fix
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Will not fix
Red Hat OpenShift Enterprise 2AffectedNo fix planned: Will not fix
Red Hat JBoss A-MQ 6.1Fixed RHSA-2014:1351
Red Hat JBoss Fuse 6.1Fixed RHSA-2014:1351
Not affected: 3 products
  • Red Hat BPM Suite 6
  • Red Hat JBoss BRMS 6
  • Red Hat JBoss Fuse Service Works 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-0225
  2. 2026-10-03 Alias added: GHSA-f93f-g33r-8pcp

References

Advisory 2

Other 4

  • TI-2017-05637 Improper input validation in Pivotal Spring Data REST and Spring Boot CVSS 3.0CRITICAL 9.8
  • TI-2016-04299 When processing authorization requests using the whitelabel views in Spring Security… CVSS 3.0HIGH 8.8
  • TI-2018-01165 Code injection in Pivotal Spring Security OAuth CVSS 3.0CRITICAL 9.8
  • TI-2018-11237 DoS Attack via Range Requests CVSS 3.1HIGH 7.5
  • TI-2019-02791 Apps Manager unverified SSL certs in Cloud Controller proxy CVSS 3.0CRITICAL 9.8
  • TI-2018-11239 On Demand Services SDK Timing Attack Vulnerability CVSS 3.0CRITICAL 9.8
See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences