Missing XML Validation in Spring Framework
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2013-7315US | medium6.8 | — | ||
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-depende… | ||||
02
references
External citations — patches, advisories, analysis.
- http://seclists.org/bugtraq/2013/Aug/154WEB
- http://seclists.org/fulldisclosure/2013/Nov/14WEB
- http://www.debian.org/security/2014/dsa-2842WEB
- http://www.securityfocus.com/bid/77998WEB
- https://github.com/spring-projects/spring-framework/commit/434735fbf6e7f9051af2ef027657edb99120b173WEB
- https://github.com/spring-projects/spring-framework/commit/7576274874deeccb6da6b09a8d5bd62e8b5538b7WEB
- https://github.com/spring-projects/spring-framework/issues/15432WEB
- https://jira.spring.io/browse/SPR-10806?redirect=falseWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan