CVE-2013-6429
NoneCVSS
—
EPSS
90.6%
Published
Jan 26, 2014
CISA due date
—
The record
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.springframework:spring-web | 0 | 3.2.5.RELEASE |
| Debian:11 | libspring-java | 0 | 3.0.6.RELEASE-11 |
| Debian:12 | libspring-java | 0 | 3.0.6.RELEASE-11 |
| Debian:13 | libspring-java | 0 | 3.0.6.RELEASE-11 |
| Debian:7 | libspring-java | 0 | 3.0.6.RELEASE-6+deb7u2 |
| Mageia:3 | springframework | 0 | 3.1.1-21.2.mga3 |
| Mageia:4 | springframework | 0 | 3.1.4-2.1.mga4 |
| Ubuntu:14.04:LTS | libspring-java | 0 | 3.0.6.RELEASE-13 |
| maven | org.springframework/spring-web | 3-alpha0 | No fix |
| maven | org.springframework/spring-web | 4-alpha0 | No fix |
Related vulnerabilities
- CVE-2025-41234 Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an… Also affects org.springframework:spring-web
- CVE-2024-38820 Spring Framework DataBinder Case Sensitive Match Exception Also affects org.springframework:spring-web
- CVE-2024-38809 Applications that parse ETags from "If-Match" or "If-None-Match" request headers are… Also affects org.springframework:spring-web
- CVE-2024-22262 Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. Also affects org.springframework:spring-web
- CVE-2024-22259 Applications that use UriComponentsBuilder in Spring Framework to parse an externally… Also affects org.springframework:spring-web
- CVE-2024-22243 Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. Also affects org.springframework:spring-web
- CVE-2016-1000027 Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution… Also affects org.springframework:spring-web
- CVE-2025-41249 The Spring Framework annotation detection mechanism may not correctly resolve annotations… Also affects libspring-java