CVE-2014-0054 EPSS 91.4%

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does…

Summary

The Jaxb2RootElementHttpMessageConverter in Spring MVC, part of the Spring Framework before 3.2.8 and 4.0.0 before 4.0.2, fails to disable external entity resolution when parsing XML. An attacker who can send crafted XML to an affected endpoint can read arbitrary files, cause a denial of service, or conduct CSRF attacks.

Official description · CVE.org

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.

Breakdown

20.0 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Disclosed on 17 Apr 2014. No public exploit code or confirmed exploitation is recorded.

See the family tree

A fix was bypassed or incomplete once over 3 months.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2013-4152The Spring OXM wrapper in Spring Framework before 3.2.4 and…23 Jan 2014
same family
CVE-2013-7315The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1…23 Jan 2014
same family
CVE-2013-6429The SourceHttpMessageConverter in Spring MVC in Spring Framework…26 Jan 2014
incomplete fixHigh
Why these are linked:
- Stated in the CVE textNOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
This CVECVE-2014-0054The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring…17 Apr 2014

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.springframework:spring-webmvc.

Mavenorg.springframework:spring-webmvcGHSA-8cmm-qj8g-fcp6

Upgrade to 4.0.2

Still affected on this line by CVE-2022-22965 (fixed in 5.2.20.RELEASE, a newer line); CVE-2024-38819 (no fix published).

Set the version to 4.0.2 or later in your pom.xml or build.gradle.

The first fix for CVE-2014-0054.

Affected versions, by release line

If you run	Upgrade to
4.0.0 up to 4.0.2	4.0.2
All versions before 3.2.8 Still affected on this line by CVE-2022-22965 (fixed in 5.2.20.RELEASE, a newer line); CVE-2024-38819 (no fix published).	3.2.8

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

5 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-3163

No public exploit code found.

, 31 Oct 2026

91.4%Top 0.19%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.81%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9981 20.0/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total20.0

Record

Published: 17 Apr 2014
Modified: 6 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

References

vdb-entry 1

x_refsource_CONFIRM 2

vendor-advisory 1

third-party-advisory 1

techniques