Vulnerability in Springsource Spring Framework
CVE-2013-7315
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
EPSS: 0.051 (91.7th percentile) — read the EPSS interpretation.
Affected products
- Springsource Spring_framework — versions 3.0.0, 3.0.0.m1, 3.0.0.m2
- Vmware Spring_framework — versions 3.0.6, 3.0.7, 3.1.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- cve@mitre.org (mailing-list, x_refsource_FULLDISC)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (vendor-advisory, x_refsource_DEBIAN)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM, Exploit, Patch)
Frequently asked questions
- What is CVE-2013-7315?
- CVE-2013-7315 is a vulnerability in Springsource Spring Framework, classified under CWE-264. Published 2014-01-23.
- Is CVE-2013-7315 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.