CVE-2014-1904
pivotal software spring framework: no CVSS score yet. EPSS 6.9% chance of exploitation in the next 30 days. Fixed in org.springframework:spring-webmvc 3.2.8.RELEASE, 4.0.2.RELEASE.
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
- EPSS
- 6.9% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pivotal_software:spring_framework
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-ff7p-jqjm-v66h | Maven | org.springframework:spring-webmvc | >=3.0.0 <3.2.8.RELEASE | 3.2.8.RELEASE |
| GHSA-ff7p-jqjm-v66h | Maven | org.springframework:spring-webmvc | >=4.0.0 <4.0.2.RELEASE | 4.0.2.RELEASE |