CVE-2013-4152
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 25.5%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 25.53% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- springsource/spring framework · vmware/spring framework
- Source
- secalert@redhat.com
References
- http://rhn.redhat.com/errata/RHSA-2014-0212.html
- http://rhn.redhat.com/errata/RHSA-2014-0245.html
- http://rhn.redhat.com/errata/RHSA-2014-0254.html
- http://rhn.redhat.com/errata/RHSA-2014-0400.html
- http://seclists.org/bugtraq/2013/Aug/154
- http://seclists.org/fulldisclosure/2013/Nov/14
- http://secunia.com/advisories/56247
- http://secunia.com/advisories/57915
- http://www.debian.org/security/2014/dsa-2842
- http://www.gopivotal.com/security/cve-2013-4152Vendor Advisory
- http://www.securityfocus.com/bid/61951
- https://github.com/spring-projects/spring-framework/pull/317/filesPatch
- https://jira.springsource.org/browse/SPR-10806Exploit, Patch
- http://rhn.redhat.com/errata/RHSA-2014-0212.html
- http://rhn.redhat.com/errata/RHSA-2014-0245.html
- http://rhn.redhat.com/errata/RHSA-2014-0254.html
- http://rhn.redhat.com/errata/RHSA-2014-0400.html
- http://seclists.org/bugtraq/2013/Aug/154
- http://seclists.org/fulldisclosure/2013/Nov/14
- http://secunia.com/advisories/56247
- http://secunia.com/advisories/57915
- http://www.debian.org/security/2014/dsa-2842
- http://www.gopivotal.com/security/cve-2013-4152Vendor Advisory
- http://www.securityfocus.com/bid/61951
- https://github.com/spring-projects/spring-framework/pull/317/filesPatch
- https://jira.springsource.org/browse/SPR-10806Exploit, Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.