CVE-2014-0054

score

<0.1

cvss

6.8

epss

91.4%

published

2014-04-17

kev added

—

first seen

2026-10-21

Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 contains an XML External Entity (XXE) vulnerability caused by not disabling external entity resolution in Jaxb2RootElementHttpMessageConverter, letting remote attackers read arbitrary files, cause denial of service, and conduct CSRF attacks via crafted XML, exploit requires sending malicious XML payloads.