Es sieht aus wie Sie aus Deutschland kommen . Wenn Sie die Pivotal Web Seite auf Deutsch anzeigen möchten, klicken Sie bitte auf die Flagge . Wenn nicht das Fenster zu schließen , und fahren in englischer Sprache.
あなたは、日本から来ているように見えます。あなたは日本語でピボタルWebサイトを表示したい場合は、フラグをクリック>し>てください。そうでない場合は、ウィンドウを閉じて、英語で進行する。

CVE-2014-1904 XSS when using Spring MVC

Severity

Moderate

Vendor

Spring by Pivotal

Versions Affected
  • Spring MVC 3.0.0 to 3.2.7
  • Spring MVC 4.0.0 to 4.0.1
  • Earlier unsupported versions may be affected
Description

When a programmer does not specify the action on the Spring form, Spring automatically populates the action field with the requested uri. An attacker can use this to inject malicious content into the form.

Mitigation

Users of affected versions should apply one of the following mitigations:

  • Users of 3.x should upgrade to 3.2.8 or later
  • Users of 4.x should upgrade to 4.0.2 or later
Credit

This issue was discovered and reported responsibly to the Pivotal security team by Paul Wowk of CAaNES LLC.

References

https://jira.springsource.org/browse/SPR-11426
https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485
https://github.com/spring-projects/spring-framework/commit/75e08695a04980dbceae6789364717e9d8764d58#diff-5c29d6685335045274d9908c5cd45e45

History

2014-Mar-11: Initial vulnerability report published.
2014-Aug-19: Correct affected versions to exclude Spring MVC 3.2.8 and include a reference to the 3.2.x commit.

Contact Pivotal
Pivotal Support