Cloudanix VulnDB

CVE-2013-4152

None

CVSS

—

EPSS

25.6%

Published

Jan 23, 2014

CISA due date

—

The record

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.

Affected packages

Ecosystem Package Introduced Fixed
Maven org.springframework:spring-oxm 0 3.2.4.RELEASE
Debian:10 libspring-java 0 3.0.6.RELEASE-10
Debian:11 libspring-java 0 3.0.6.RELEASE-10
Debian:12 libspring-java 0 3.0.6.RELEASE-10
Debian:13 libspring-java 0 3.0.6.RELEASE-10
Debian:7 libspring-java 0 3.0.6.RELEASE-6+deb7u1
Mageia:3 springframework 0 3.1.1-21.1.mga3
Red Hat:openshift:1.2::el6 activemq 0 0:5.9.0-4.redhat.610328.el6op
Red Hat:openshift:1.2::el6 activemq-client 0 0:5.9.0-4.redhat.610328.el6op
Red Hat:openshift:2.0::el6 activemq 0 0:5.9.0-4.redhat.610328.el6op
Red Hat:openshift:2.0::el6 activemq-client 0 0:5.9.0-4.redhat.610328.el6op
Ubuntu:14.04:LTS libspring-java 0 3.0.6.RELEASE-10
maven org.springframework/spring-oxm 3.0.0.RELEASE 3.2.4.RELEASE
maven org.springframework/spring-oxm 4.0.0.RELEASE 4.0.1.RELEASE

Related vulnerabilities