This vulnerability arises from improper restriction of XML External Entity references (CWE-611) in Spring REST Docs components spring-restdocs-webtestclient and spring-restdocs-restassured. When these components document a remote API accessed over HTTP, an attacker who either compromises the API or deceives the user into documenting a malicious API can cause an XXE injection attack during the next execution of the documentation-generating tests. This can lead to high confidentiality impact with limited integrity and availability impact. The affected versions explicitly include 4.0.0, 3.0.0 through 3.0.5, and 2.0.0.RELEASE through 2.0.8.RELEASE. The vendor has confirmed a patch is available, although no specific remediation details or advisories were provided in the input data.

Successful exploitation can result in disclosure of confidential information due to XXE injection when documenting a malicious or compromised remote API. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. Users should apply the official fix from the Spring project to the affected versions of Spring REST Docs. Since the vendor advisory content is not provided, check the Spring project or official Spring REST Docs release notes for the exact patched versions and update accordingly. Avoid documenting untrusted or potentially malicious remote APIs until patched.