Home / vulnerabilities Spring MVC 3.2.8 / 4.0.1 Incomplete Fix
Posted on 13 March 2014
Source : packetstormsecurity.org Link
Spring MVC's Jaxb2RootElementHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them. Jaxb2RootElementHttpMessageConverter has been modified to provide an option to control the processing of XML external entities and that processing is now disabled by default. Versions 3.0.0 through 3.2.8 and 4.0.0 through 4.0.1 are affected.
