Description
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
Affected products
- Pivotal / Spring Framework4.0.0 to 4.0.4 – 4.0.0 to 4.0.4
- Pivotal / Spring Framework3.0.0 to 3.2.8 – 3.0.0 to 3.2.8
- Pivotal / Spring FrameworkEarlier unsupported versions may be affected – Earlier unsupported versions may be affected
References
Updated 4m ago · 8 sources