Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-g6hf-f9cq-q7w7
Advisory ID github_osv/GHSA-g6hf-f9cq-q7w7
Aliases CVE-2013-6429
Summary Cross-Site Request Forgery in Spring Framework The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
Status Published
Exploitability 2.0
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-352 Cross-Site Request Forgery (CSRF)
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://rhn.redhat.com/errata/RHSA-2014-0400.html
http://secunia.com/advisories/57915
https://github.com/spring-projects/spring-framework/commit/2ae6a6a3415eebc57babcb9d3e5505887eda6d8
https://github.com/spring-projects/spring-framework/commit/7387cb990e35b0f1b573faf29d4f9ae183d7a5e
https://github.com/spring-projects/spring-framework/issues/15704
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
https://jira.spring.io/browse/SPR-11078?redirect=false
CVE-2013-6429 https://nvd.nist.gov/vuln/detail/CVE-2013-6429
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.