The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution which allows remote attackers to read arbitrary files cause a denial of service and conduct CSRF attacks via crafted XML aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152 CVE-2013-7315 and CVE-2013-6429.