GET

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

GET /api/vulnerabilities/38629?format=api
HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38629?format=api",
    "vulnerability_id": "VCID-a796-tmtn-6bac",
    "summary": "Information disclosure via SSRF\nThis package did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.",
    "aliases": [
        {
            "alias": "CVE-2014-0225"
        },
        {
            "alias": "GHSA-f93f-g33r-8pcp"
        }
    ],
    "fixed_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/53591?format=api",
            "purl": "pkg:maven/org.springframework/spring-oxm@3.2.9.RELEASE",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-oxm@3.2.9.RELEASE"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/53592?format=api",
            "purl": "pkg:maven/org.springframework/spring-oxm@4.0.5.RELEASE",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-oxm@4.0.5.RELEASE"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/53597?format=api",
            "purl": "pkg:maven/org.springframework/spring-web@3.2.9.RELEASE",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-web@3.2.9.RELEASE"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/53598?format=api",
            "purl": "pkg:maven/org.springframework/spring-web@4.0.5.RELEASE",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-web@4.0.5.RELEASE"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/62634?format=api",
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.2.8",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@3.2.8"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/62635?format=api",
            "purl": "pkg:maven/org.springframework/spring-webmvc@4.0.5",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@4.0.5"
        }
    ],
    "affected_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/53587?format=api",
            "purl": "pkg:maven/org.springframework/spring-oxm@3-alpha0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-a796-tmtn-6bac"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-oxm@3-alpha0"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/53588?format=api",
            "purl": "pkg:maven/org.springframework/spring-oxm@3.2.8.RELEASE",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-a796-tmtn-6bac"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-oxm@3.2.8.RELEASE"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/53589?format=api",
            "purl": "pkg:maven/org.springframework/spring-oxm@4-alpha0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-a796-tmtn-6bac"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-oxm@4-alpha0"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/53590?format=api",
            "purl": "pkg:maven/org.springframework/spring-oxm@4.0.4.RELEASE",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-a796-tmtn-6bac"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-oxm@4.0.4.RELEASE"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/53593?format=api",
            "purl": "pkg:maven/org.springframework/spring-web@3",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-a796-tmtn-6bac"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-web@3"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/53594?format=api",
            "purl": "pkg:maven/org.springframework/spring-web@3.2.8.RELEASE",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-a796-tmtn-6bac"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-web@3.2.8.RELEASE"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/53595?format=api",
            "purl": "pkg:maven/org.springframework/spring-web@4",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-a796-tmtn-6bac"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-web@4"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/53596?format=api",
            "purl": "pkg:maven/org.springframework/spring-web@4.0.4.RELEASE",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-a796-tmtn-6bac"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-web@4.0.4.RELEASE"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/62632?format=api",
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.0.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-a796-tmtn-6bac"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@3.0.0"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/62633?format=api",
            "purl": "pkg:maven/org.springframework/spring-webmvc@4.0.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-a796-tmtn-6bac"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@4.0.0"
        }
    ],
    "references": [
        {
            "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0225",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0225"
        },
        {
            "reference_url": "https://github.com/spring-projects/spring-framework/commit/8e096aeef55287dc829484996c9330cf755891a1",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/spring-projects/spring-framework/commit/8e096aeef55287dc829484996c9330cf755891a1"
        },
        {
            "reference_url": "https://github.com/spring-projects/spring-framework/commit/c6503ebbf7c9e21ff022c58706dbac5417b2b5eb",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/spring-projects/spring-framework/commit/c6503ebbf7c9e21ff022c58706dbac5417b2b5eb"
        },
        {
            "reference_url": "https://jira.spring.io/browse/SPR-11768",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://jira.spring.io/browse/SPR-11768"
        },
        {
            "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0225",
            "reference_id": "CVE-2014-0225",
            "reference_type": "",
            "scores": [],
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0225"
        },
        {
            "reference_url": "https://pivotal.io/security/cve-2014-0225",
            "reference_id": "CVE-2014-0225",
            "reference_type": "",
            "scores": [],
            "url": "https://pivotal.io/security/cve-2014-0225"
        },
        {
            "reference_url": "http://www.gopivotal.com/security/cve-2014-0225",
            "reference_id": "CVE-2014-0225",
            "reference_type": "",
            "scores": [],
            "url": "http://www.gopivotal.com/security/cve-2014-0225"
        },
        {
            "reference_url": "https://github.com/advisories/GHSA-f93f-g33r-8pcp",
            "reference_id": "GHSA-f93f-g33r-8pcp",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/advisories/GHSA-f93f-g33r-8pcp"
        }
    ],
    "weaknesses": [
        {
            "cwe_id": 1035,
            "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."
        },
        {
            "cwe_id": 611,
            "name": "Improper Restriction of XML External Entity Reference",
            "description": "The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output."
        },
        {
            "cwe_id": 937,
            "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."
        }
    ],
    "exploits": [],
    "severity_range_score": null,
    "exploitability": null,
    "weighted_severity": null,
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-a796-tmtn-6bac"
}