Vulnerability in Springsource Spring_framework
CVE-2013-4152
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and cond…
EPSS: 0.680 (98.6th percentile) — read the EPSS interpretation.
Affected products
- Springsource Spring_framework — versions 3.0.0, 3.0.0.m1, 3.0.0.m2
- Vmware Spring_framework — versions 3.0.6, 3.0.7, 3.1.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_CONFIRM, Patch)
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- 61951 (vdb-entry, x_refsource_BID)
- 20131102 XXE Injection in Spring Framework (mailing-list, x_refsource_FULLDISC)
- RHSA-2014:0254 (x_refsource_REDHAT, vendor-advisory)
- 20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework (mailing-list, x_refsource_BUGTRAQ)
- DSA-2842 (vendor-advisory, x_refsource_DEBIAN)
- RHSA-2014:0212 (x_refsource_REDHAT, vendor-advisory)
- RHSA-2014:0400 (x_refsource_REDHAT, vendor-advisory)
- RHSA-2014:0245 (x_refsource_REDHAT, vendor-advisory)
Frequently asked questions
- What is CVE-2013-4152?
- CVE-2013-4152 is a vulnerability in Springsource Spring_framework, classified under CWE-264. Published 2014-01-23.
- Is CVE-2013-4152 known to be exploited?
- 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.