CVE-2013-7315
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and…
Does this matter?
Lower severity and a low EPSS score (5.07%). Track it; it rarely justifies an emergency change on its own.
Description
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 5.07% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- springsource/spring framework · vmware/spring framework
- Source
- cve@mitre.org
References
- http://seclists.org/bugtraq/2013/Aug/154
- http://seclists.org/fulldisclosure/2013/Nov/14
- http://www.debian.org/security/2014/dsa-2842
- http://www.gopivotal.com/security/cve-2013-4152Vendor Advisory
- http://www.securityfocus.com/bid/77998
- https://jira.springsource.org/browse/SPR-10806Exploit, Patch
- http://seclists.org/bugtraq/2013/Aug/154
- http://seclists.org/fulldisclosure/2013/Nov/14
- http://www.debian.org/security/2014/dsa-2842
- http://www.gopivotal.com/security/cve-2013-4152Vendor Advisory
- http://www.securityfocus.com/bid/77998
- https://jira.springsource.org/browse/SPR-10806Exploit, Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.