VulnerableCode Package Details - pkg:maven/org.springframework/spring-oxm@3.2.3.RELEASE

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:maven/org.springframework/spring-oxm@3.2.3.RELEASE

Essentials
History (4)

purl	pkg:maven/org.springframework/spring-oxm@3.2.3.RELEASE

Next non-vulnerable version	4.2.9.RELEASE
Latest non-vulnerable version	5.2.9.RELEASE
Risk	3.1

Vulnerabilities affecting this package (4)

Vulnerability	Summary	Fixed by
VCID-5xyh-x7zt-aycz Aliases: CVE-2013-4152 GHSA-rp4p-g69r-438x	Improper Restriction of XML External Entity Reference The Spring OXM wrapper when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.	3.2.4.RELEASE Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 4.0.1.RELEASE Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-a796-tmtn-6bac Aliases: CVE-2014-0225 GHSA-f93f-g33r-8pcp	Information disclosure via SSRF This package did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.	3.2.9.RELEASE Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 4.0.5.RELEASE Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-fra1-reqm-kfdb Aliases: CVE-2020-5421 GHSA-rv39-3qh7-9v7w	Remote file disclosure In Spring Framework the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.	4.2.9.RELEASE Affected by 0 other vulnerabilities. 4.3.28.RELEASE Affected by 0 other vulnerabilities. 4.3.29.RELEASE Affected by 0 other vulnerabilities. 5.0.18.RELEASE Affected by 0 other vulnerabilities. 5.0.19.RELEASE Affected by 0 other vulnerabilities. 5.1.17.RELEASE Affected by 0 other vulnerabilities. 5.1.18.RELEASE Affected by 0 other vulnerabilities. 5.2.8.RELEASE Affected by 0 other vulnerabilities. 5.2.9.RELEASE Affected by 0 other vulnerabilities.
VCID-gwpy-9eej-kbgd Aliases: CVE-2013-7315 GHSA-vp63-rrcm-9mph	XML External Entity (XXE) injection This package does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.	3.2.4.RELEASE Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-04T20:39:09.950746+00:00	GitLab Importer	Affected by	VCID-fra1-reqm-kfdb	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-oxm/CVE-2020-5421.yml	38.6.0
2026-06-04T20:08:05.672872+00:00	GitLab Importer	Affected by	VCID-a796-tmtn-6bac	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-oxm/CVE-2014-0225.yml	38.6.0
2026-06-04T20:03:57.256803+00:00	GitLab Importer	Affected by	VCID-5xyh-x7zt-aycz	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-oxm/CVE-2013-4152.yml	38.6.0
2026-06-02T04:42:39.746210+00:00	GitLab Importer	Affected by	VCID-gwpy-9eej-kbgd	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-oxm/CVE-2013-7315.yml	38.6.0