CVE-2014-0225
Estado: ModificadaAlta (8.8)—
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.70%
- Percentil entre todas las CVEs puntuadas: 76
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-611
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2014-0225",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.8,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security_alert@emc.com",
"affectedData": [
{
"vendor": "Pivotal",
"product": "Spring Framework",
"versions": [
{
"status": "affected",
"version": "4.0.0 to 4.0.4"
},
{
"status": "affected",
"version": "3.0.0 to 3.2.8"
},
{
"status": "affected",
"version": "Earlier unsupported versions may be affected"
}
]
}
]
}
],
"published": "2017-05-25T17:29:00.207",
"references": [
{
"url": "https://pivotal.io/security/cve-2014-0225",
"tags": [
"Vendor Advisory"
],
"source": "security_alert@emc.com"
},
{
"url": "https://pivotal.io/security/cve-2014-0225",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-611"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack."
},
{
"lang": "es",
"value": "Al procesar un documento XML proporcionado por el usuario, el Framework Spring, versiones de la 4.0.0 a la 4.0.4 y de la 3.0.0 a la 3.2.8 y otras versiones anteriores ya no soportadas, no desactiva por defecto la resolución de las referencias URI en una declaración DTD, lo que habilita ataques de tipo XXE."
}
],
"lastModified": "2026-06-17T00:02:34.870",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pivotal_software:spring_framework:3.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C4552840-9F26-478E-8875-5B2809C7FD69"
},
{
"criteria": "cpe:2.3:a:pivotal_software:spring_framework:3.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4A6266B7-5676-4786-9A5C-1E31D21DC76D"
},
{
"criteria": "cpe:2.3:a:pivotal_software:spring_framework:3.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E02D9007-1215-4FD1-822A-BA95748E75D8"
},
{
"criteria": "cpe:2.3:a:pivotal_software:spring_framework:4.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1C04E981-6FF9-4842-912B-EB5D3E9E7A68"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5CBB128-9F47-45ED-8A4A-62C6439D01DC"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0915A639-5F69-4054-A01D-D6E9B9DAF277"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3812C2F2-E861-4038-9D80-4C2EB311AA90"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "99B37852-F488-4FA1-894B-A5B390567CF8"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8AE8E872-CC85-44A9-A3FC-EEDCDE4E2DCC"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B9D5172D-5E19-40C1-8C1B-CC22706E780D"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.0.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "46E410D2-DA53-4806-B296-451C3D9CDEEA"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.1.0:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "753C95ED-5162-4156-B8A1-011A1DAADAD9"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.1.0:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1996FA84-C504-4010-9984-B563514F1AB9"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B61F3E25-A415-4A25-91D6-4FBA6F575AAB"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A2C4C81-2E79-411C-AEB8-A5E40FC28D31"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "010915FE-3BCE-4652-8D8B-47EE085F3BEE"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D16C8EFA-F1E4-48C3-BC86-A132873426C4"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.2.0:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F2260DAE-0090-4624-A6BF-1F9406659C0A"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.2.0:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D57791EA-3A91-4BEE-AF1F-B64D0FC47723"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.2.0:rc2-a:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DA88332D-07C0-4C95-BC27-75536F09613B"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2E2EA60-735E-431E-BEFE-DC5C1046E532"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DFD1FA92-7BFC-4874-89FC-BE0F378F0DB3"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7CC0E26F-2E8B-4B30-8C43-8BD2015EBB88"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3CB73406-5FE4-438E-BCB7-57FBF6EC38D0"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B76F06BC-F53E-4E37-B84F-3E992D459A49"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD8CC0CF-61DE-4E3A-80DD-4AD34EBDF419"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.2.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "09D49870-9E17-4049-9ABB-311C319A0E8F"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:3.2.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB9CE889-FBC5-4078-ABAC-8BC6CA235D04"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:4.0.0:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4A94E509-0E06-4FD0-BA61-292515031BAD"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:4.0.0:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5CF3CDB-339A-46A5-BCFE-4DF4120EAD3E"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A0A0C100-FAD1-4004-AA42-AE508F4D540E"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BE8D78C3-5C4D-4FAD-BC0F-1AD8C55D88F2"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:4.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BDB13067-D890-414E-B7CD-A3C11A1DBC9F"
},
{
"criteria": "cpe:2.3:a:vmware:spring_framework:4.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0AA135B9-819D-4FAF-8F98-EA4549575327"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security_alert@emc.com"
}