Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-vp63-rrcm-9mph
Advisory ID github_osv/GHSA-vp63-rrcm-9mph
Aliases CVE-2013-7315
Summary Missing XML Validation in Spring Framework The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-112 Missing XML Validation
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://seclists.org/bugtraq/2013/Aug/154
http://seclists.org/fulldisclosure/2013/Nov/14
https://github.com/spring-projects/spring-framework/commit/434735fbf6e7f9051af2ef027657edb99120b173
https://github.com/spring-projects/spring-framework/commit/7576274874deeccb6da6b09a8d5bd62e8b5538b7
https://github.com/spring-projects/spring-framework/issues/15432
https://jira.spring.io/browse/SPR-10806?redirect=false
http://www.debian.org/security/2014/dsa-2842
http://www.securityfocus.com/bid/77998
CVE-2013-7315 https://nvd.nist.gov/vuln/detail/CVE-2013-7315
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.