org.springframework vulnerabilities

Products

• org.springframework/spring-webmvc 27
• org.springframework/spring-webflux 20
• org.springframework/spring-core 19
• org.springframework/spring-web 13
• org.springframework/spring-expression 8
• org.springframework/spring 3
• org.springframework/spring-context 3
• org.springframework/spring-messaging 3
• org.springframework/spring-beans 2
• org.springframework/spring-oxm 2
• org.springframework/spring-websocket 2
• org.springframework/spring-framework-bom 1
• org.springframework/spring-jms 1

Latest org.springframework CVEs

Newest publication first · page 4 of 4

1. CVE-2014-3625 Improper Limitation of a Pathname to a Restricted Directory in Spring Framework

   Published 2014-11-20

   Medium·CVSS 5.0 EPSS 9.9%

   Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

2. CVE-2014-0054 Cross-Site Request Forgery in Spring Framework

   Published 2014-04-17

   Medium·CVSS 6.8 EPSS 91.4%

   The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML,...

3. CVE-2014-1904 Improper Neutralization of Input During Web Page Generation in Spring Framework

   Published 2014-03-20

   Medium·CVSS 4.3 EPSS 6.9%

   Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.

4. CVE-2013-6429 Cross-Site Request Forgery in Spring Framework

   Published 2014-01-26

   Medium·CVSS 6.8 EPSS 90.6%

   The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, ak...

5. CVE-2013-7315 Missing XML Validation in Spring Framework

   Published 2014-01-23

   Medium·CVSS 6.8 EPSS 5.1%

   The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafte...

6. CVE-2013-4152 Cross-Site Request Forgery in Spring Framework

   Published 2014-01-23

   Medium·CVSS 6.8 EPSS 25.6%

   The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external enti...

7. CVE-2011-2730 Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework

   Published 2012-12-05

   High·CVSS 7.5 EPSS 11.8%

   VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a)...

8. CVE-2011-2894 Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data

   Published 2011-10-04

   Medium·CVSS 6.8 EPSS 8.6%

   Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) seri...

9. CVE-2010-1622 Improper Control of Generation of Code ('Code Injection') in Spring Framework

   Published 2010-06-21

   Medium·CVSS 6.0 EPSS 52.0% Public exploit

   SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

10. CVE-2009-1190 Spring Framework Inefficient Regular Expression Complexity

    Published 2009-04-27

    Medium·CVSS 5.0 EPSS 2.8%

    Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6, when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 and dm Server 1.0.0 through 1.0.2, allows...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.