CVE-2014-1904

Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*

History

21 Nov 2024, 02:05

Type Values Removed Values Added
References () http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt - Vendor Advisory () http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt - Vendor Advisory
References () http://rhn.redhat.com/errata/RHSA-2014-0400.html - Third Party Advisory () http://rhn.redhat.com/errata/RHSA-2014-0400.html - Third Party Advisory
References () http://seclists.org/fulldisclosure/2014/Mar/101 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2014/Mar/101 - Mailing List, Third Party Advisory
References () http://secunia.com/advisories/57915 - Permissions Required () http://secunia.com/advisories/57915 - Permissions Required
References () http://www.gopivotal.com/security/cve-2014-1904 - Patch, Vendor Advisory () http://www.gopivotal.com/security/cve-2014-1904 - Patch, Vendor Advisory
References () http://www.securityfocus.com/archive/1/531422/100/0/threaded - Broken Link () http://www.securityfocus.com/archive/1/531422/100/0/threaded - Broken Link
References () http://www.securityfocus.com/bid/66137 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/66137 - Third Party Advisory, VDB Entry
References () https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485 - Patch, Third Party Advisory () https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485 - Patch, Third Party Advisory
References () https://jira.springsource.org/browse/SPR-11426 - Permissions Required () https://jira.springsource.org/browse/SPR-11426 - Permissions Required

Information

Published : 2014-03-20 16:55

Updated : 2024-11-21 02:05


NVD link : CVE-2014-1904

Mitre link : CVE-2014-1904

CVE.ORG link : CVE-2014-1904


JSON object : View

Products Affected

pivotal_software

  • spring_framework
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')