Description
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
Remediation
References
https://pivotal.io/security/cve-2014-0225
Related Vulnerabilities
CVE-2022-45389 Vulnerability in maven package com.cloudbees.jenkins.plugins:xpdev
CVE-2023-24433 Vulnerability in maven package io.jenkins.plugins:macstadium-orka
CVE-2017-7661 Vulnerability in maven package org.apache.cxf.fediz:fediz-spring2
CVE-2023-34150 Vulnerability in maven package org.apache.any23:apache-any23-encoding
CVE-2020-24922 Vulnerability in maven package com.xuxueli:xxl-job-admin