PatchTheCVEspringsource vulnerabilities
Recent CVEs affecting springsource products. 5 tracked.
springsource has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2014-04-17. Highest priority: CVE-2013-4152 (score 53/100).
- CVE-2014-0054 MEDIUM 6.8 DOWNGRADE UPGRADE The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2
- CVE-2013-7315 MEDIUM 6.8 DOWNGRADE UPGRADE The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity
- CVE-2013-4152 MEDIUM 6.8 DOWNGRADE UPGRADE The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not
- CVE-2012-1833 MEDIUM 5.0 UPGRADE VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which
- CVE-2011-2730 HIGH 7.5 UPGRADE VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container s
FAQ
How do I fix springsource vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is springsource being exploited right now?
None of the tracked springsource CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which springsource CVE should I patch first?
CVE-2013-4152 currently ranks highest (53/100): The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not.