CVE-2013-4152 Cross-Site Request Forgery in Spring Framework
MediumCVSS 6.8
EPSS 25.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-oxm(Maven) | < 3.2.4.RELEASE | 3.2.4.RELEASE |
| org.springframework/spring-oxm(Maven) | = 3.0.0.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.0.1.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.0.2.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.0.3.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.0.4.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.0.5.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.0.6.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.0.7.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.1.0.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.1.1.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.1.2.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.1.3.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.1.4.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.2.0.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.2.1.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.2.2.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.2.3.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | <= 3.2.3.RELEASE | No fix listed |
| debian/libspring-java(Debian:12) | < 3.0.6.RELEASE-10 | 3.0.6.RELEASE-10 |
| debian/libspring-java(Debian:13) | < 3.0.6.RELEASE-10 | 3.0.6.RELEASE-10 |
| debian/libspring-java(Debian:14) | < 3.0.6.RELEASE-10 | 3.0.6.RELEASE-10 |
| springsource spring framework | = 3.0.0 | No fix listed |
| springsource spring framework | = 3.0.0-m1 | No fix listed |
| springsource spring framework | = 3.0.0-m2 | No fix listed |
Show 24 more
| Product | Affected versions | Fixed in |
|---|---|---|
| springsource spring framework | = 3.0.0-m3 | No fix listed |
| springsource spring framework | = 3.0.0-m4 | No fix listed |
| springsource spring framework | = 3.0.0-rc1 | No fix listed |
| springsource spring framework | = 3.0.0-rc2 | No fix listed |
| springsource spring framework | = 3.0.0-rc3 | No fix listed |
| springsource spring framework | = 3.0.0.m1 | No fix listed |
| springsource spring framework | = 3.0.0.m2 | No fix listed |
| springsource spring framework | = 3.0.1 | No fix listed |
| springsource spring framework | = 3.0.2 | No fix listed |
| springsource spring framework | = 3.0.3 | No fix listed |
| springsource spring framework | = 3.0.4 | No fix listed |
| springsource spring framework | = 3.0.5 | No fix listed |
| VMware spring framework | <= 3.2.3 | No fix listed |
| VMware spring framework | = 3.0.6 | No fix listed |
| VMware spring framework | = 3.0.7 | No fix listed |
| VMware spring framework | = 3.1.0 | No fix listed |
| VMware spring framework | = 3.1.1 | No fix listed |
| VMware spring framework | = 3.1.2 | No fix listed |
| VMware spring framework | = 3.1.3 | No fix listed |
| VMware spring framework | = 3.1.4 | No fix listed |
| VMware spring framework | = 3.2.0 | No fix listed |
| VMware spring framework | = 3.2.1 | No fix listed |
| VMware spring framework | = 3.2.2 | No fix listed |
| VMware spring framework | = 4.0.0-milestone1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- RHSA-2014:0212 vendor-advisory
- RHSA-2014:0245 vendor-advisory
- RHSA-2014:0254 vendor-advisory
- RHSA-2014:0400 vendor-advisory
- 20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework mailing-list
- 20131102 XXE Injection in Spring Framework mailing-list
- DSA-2842 vendor-advisory
- www.gopivotal.com vendor-advisory
- github.com
- Debian Security Tracker CVE-2013-4152 vendor-advisory
- 56247 third-party-advisory
- 57915 third-party-advisory
- 61951 vdb-entry
- jira.springsource.org exploit patch
- bugs.debian.org issue-tracking