Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-rp4p-g69r-438x
Advisory ID github_osv/GHSA-rp4p-g69r-438x
Aliases CVE-2013-4152
Summary Cross-Site Request Forgery in Spring Framework The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-352 Cross-Site Request Forgery (CSRF)
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://rhn.redhat.com/errata/RHSA-2014-0212.html
http://rhn.redhat.com/errata/RHSA-2014-0245.html
http://rhn.redhat.com/errata/RHSA-2014-0254.html
http://rhn.redhat.com/errata/RHSA-2014-0400.html
http://seclists.org/bugtraq/2013/Aug/154
http://seclists.org/fulldisclosure/2013/Nov/14
https://github.com/spring-projects/spring-framework/commit/434735fbf6e7f9051af2ef027657edb99120b173
https://github.com/spring-projects/spring-framework/commit/7576274874deeccb6da6b09a8d5bd62e8b5538b7
https://github.com/spring-projects/spring-framework/pull/317/files
http://www.debian.org/security/2014/dsa-2842
CVE-2013-4152 https://nvd.nist.gov/vuln/detail/CVE-2013-4152
CVE-2013-4152 http://www.gopivotal.com/security/cve-2013-4152
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.