{"action":"Upgrade org.springframework:spring-webmvc to 3.2.8.RELEASE (3.x) or 4.0.2.RELEASE (4.x) or later.","affected":[{"fixed":"3.2.8.RELEASE","introduced":"3.0.0"},{"fixed":"4.0.2.RELEASE","introduced":"4.0.0"}],"component":"org.springframework:spring-webmvc","cve_ids":["CVE-2014-1904"],"ecosystem":"Maven","epss":0.06896,"exploited":false,"fixed_versions":["3.2.8.RELEASE","4.0.2.RELEASE"],"ghsa_id":"GHSA-ff7p-jqjm-v66h","id":"tcs_01M5N8VVVD0HJ6PCB1RMRY9J45","modified_at":"2024-12-03T06:07:43.464005Z","published_at":"2022-05-14T01:14:55Z","references":["https://osv.dev/vulnerability/GHSA-ff7p-jqjm-v66h","https://nvd.nist.gov/vuln/detail/CVE-2014-1904","https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485","https://github.com/spring-projects/spring-framework/commit/75e08695a04980dbceae6789364717e9d8764d58#diff-5c29d6685335045274d9908c5cd45e45","https://github.com/spring-projects/spring-framework","https://jira.springsource.org/browse/SPR-11426","http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt","http://rhn.redhat.com/errata/RHSA-2014-0400.html","http://seclists.org/fulldisclosure/2014/Mar/101","http://secunia.com/advisories/57915"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-ff7p-jqjm-v66h","url":"https://osv.dev/vulnerability/GHSA-ff7p-jqjm-v66h"}],"summary":"Improper Neutralization of Input During Web Page Generation in Spring Framework"}