Description
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
Remediation
References
https://pivotal.io/security/cve-2014-0225
Related Vulnerabilities
CVE-2023-25572 Vulnerability in npm package ra-ui-materialui
CVE-2020-16024 Vulnerability in npm package electron
CVE-2023-2195 Vulnerability in maven package org.jenkins-ci.plugins:codedx
CVE-2015-5174 Vulnerability in maven package org.apache.tomcat:catalina
CVE-2022-42124 Vulnerability in maven package com.liferay:com.liferay.layout.page.template.service