CVE-2014-1904

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txtVendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-0400.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2014/Mar/101Mailing List, Third Party Advisory
http://secunia.com/advisories/57915Permissions Required
http://www.gopivotal.com/security/cve-2014-1904Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/531422/100/0/threadedBroken Link
http://www.securityfocus.com/bid/66137Third Party Advisory, VDB Entry
https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485Patch, Third Party Advisory
https://jira.springsource.org/browse/SPR-11426Permissions Required
http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txtVendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-0400.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2014/Mar/101Mailing List, Third Party Advisory
http://secunia.com/advisories/57915Permissions Required
http://www.gopivotal.com/security/cve-2014-1904Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/531422/100/0/threadedBroken Link
http://www.securityfocus.com/bid/66137Third Party Advisory, VDB Entry
https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485Patch, Third Party Advisory
https://jira.springsource.org/browse/SPR-11426Permissions Required

Timeline

Published: Mar 20, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-190510.0Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPr CVE-2014-19064.3Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow CVE-2014-19076.4Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote CVE-2014-19085.0The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integra CVE-2014-19097.5Integer signedness error in system/core/adb/adb_client.c in Android Debug Bridge (ADB) for Android 4.4 in the Android SDK Platform Tools 18.CVE-2014-19105.8Citrix ShareFile Mobile and ShareFile Mobile for Tablets before 2.4.4 for Android do not verify X.509 certificates from SSL servers, which a CVE-2014-19117.8The Foscam FI8910W camera with firmware before 11.37.2.55 allows remote attackers to obtain sensitive video and image data via a blank usern CVE-2014-19127.5Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x befor CVE-2014-19144.3Multiple cross-site scripting (XSS) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arb CVE-2014-19156.8Multiple cross-site request forgery (CSRF) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hij CVE-2014-19165.0The (1) opus_packet_get_nb_frames and (2) opus_packet_get_samples_per_frame functions in the client in MumbleKit before commit fd190328a9b24 CVE-2014-19217.5parcimonie before 0.8.1, when using a large keyring, sleeps for the same amount of time between fetches, which allows attackers to correlate