Vulnerability in Springsource Spring_framework
CVE-2013-7315
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of ser…
EPSS: 0.002 (47.8th percentile) — read the EPSS interpretation.
Affected products
- Springsource Spring_framework — versions 3.0.0, 3.0.0.m1, 3.0.0.m2
- Vmware Spring_framework — versions 3.0.6, 3.0.7, 3.1.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- 20131102 XXE Injection in Spring Framework (mailing-list, x_refsource_FULLDISC)
- 20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework (mailing-list, x_refsource_BUGTRAQ)
- DSA-2842 (vendor-advisory, x_refsource_DEBIAN)
- 77998 (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM, Exploit, Patch)
Frequently asked questions
- What is CVE-2013-7315?
- CVE-2013-7315 is a vulnerability in Springsource Spring_framework, classified under CWE-264. Published 2014-01-23.
- Is CVE-2013-7315 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.