3.0.6 and 2.5.6SEC03 require explicit configuration to fix this - they are not safe by default. 3.1 is safe without config. see http://www.h-online.com/open/n

3.0.6 and 2.5.6SEC03 require explicit configuration to fix this - they are not safe by default. 3.1 is safe without config. see http://www.h-online.com/open/news/item/The-ghost-of-a-Spring-Framework-bug-haunts-old-code-1786850.html http://www.h-online.com/open/news/item/The-ghost-of-a-Spring...