GCVE - cpe:2.3:a:vmware:spring_framework:3.1.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:vmware:spring_framework:3.1.0:*:*:*:*:*:*:*

part: a version: 3.1.0 update: *

Vendor	Vmware (`7bb62c7c-2241-5a0b-8dbc-5f13251fb24e`)
Product	Spring Framework (`41621cc5-d045-5d17-9682-c6f08d8595d7`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-0054`	vulnerable	2026-06-08 05:05:11.008907	Details available The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429. Published: 2014-04-17T14:00:00.000Z Updated: 2024-08-06T09:05:38.783Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/66148 https://jira.spring.io/browse/SPR-11376 http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html http://rhn.redhat.com/errata/RHSA-2014-0400.html http://secunia.com/advisories/57915	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-7315`	vulnerable	2026-06-08 05:05:09.697329	Details available The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions. Published: 2014-01-23T21:00:00.000Z Updated: 2024-08-06T18:01:20.592Z Open on db.gcve.eu Reference links http://www.gopivotal.com/security/cve-2013-4152 http://seclists.org/fulldisclosure/2013/Nov/14 http://seclists.org/bugtraq/2013/Aug/154 http://www.debian.org/security/2014/dsa-2842 http://www.securityfocus.com/bid/77998	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4152`	vulnerable	2026-06-08 05:04:34.231000	Details available The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue. Published: 2014-01-23T21:00:00.000Z Updated: 2024-08-06T16:30:49.922Z Open on db.gcve.eu Reference links https://github.com/spring-projects/spring-framework/pull/317/files http://www.gopivotal.com/security/cve-2013-4152 http://www.securityfocus.com/bid/61951 http://seclists.org/fulldisclosure/2013/Nov/14 http://rhn.redhat.com/errata/RHSA-2014-0254.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.