CVE-2014-1904 Improper Neutralization of Input During Web Page Generation in Spring Framework
MediumCVSS 4.3
EPSS 6.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-webmvc(Maven) | >= 3.0.0, < 3.2.8.RELEASE | 3.2.8.RELEASE |
| org.springframework/spring-webmvc(Maven) | = 3.0.0.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.0.1.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.0.2.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.0.3.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.0.4.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.0.5.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.0.6.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.0.7.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.1.0.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.1.1.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.1.2.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.1.3.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.1.4.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.0.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.1.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.2.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.3.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.4.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.5.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.6.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.7.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | >= 4.0.0, < 4.0.2.RELEASE | 4.0.2.RELEASE |
| org.springframework/spring-webmvc(Maven) | = 4.0.0.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 4.0.1.RELEASE | No fix listed |
Show 7 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-webmvc(Maven) | >= 3.0.0, <= 3.2.7.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | >= 4.0.0, <= 4.0.1.RELEASE | No fix listed |
| debian/libspring-java(Debian:12) | < 3.0.6.RELEASE-13 | 3.0.6.RELEASE-13 |
| debian/libspring-java(Debian:13) | < 3.0.6.RELEASE-13 | 3.0.6.RELEASE-13 |
| debian/libspring-java(Debian:14) | < 3.0.6.RELEASE-13 | 3.0.6.RELEASE-13 |
| pivotal software spring framework | >= 3.0.0, < 3.2.8 | 3.2.8 |
| pivotal software spring framework | >= 4.0.0, < 4.0.2 | 4.0.2 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com patch
- github.com product
- jira.springsource.org permissions-required
- docs.spring.io vendor-advisory
- RHSA-2014:0400 third-party-advisory vendor-advisory
- 20140312 CVE-2014-1904 XSS when using Spring MVC mailing-list third-party-advisory
- 57915 permissions-required third-party-advisory
- github.com
- Debian Security Tracker CVE-2014-1904 vendor-advisory
- www.gopivotal.com patch vendor-advisory
- 20140311 CVE-2014-1904 XSS when using Spring MVC broken-link mailing-list
- 66137 third-party-advisory vdb-entry
- bugs.debian.org issue-tracking