CVE-2013-6429 Cross-Site Request Forgery in Spring Framework
MediumCVSS 6.8
EPSS 90.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-web(Maven) | < 3.2.5.RELEASE | 3.2.5.RELEASE |
| org.springframework/spring-web(Maven) | = 1.0 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.0-rc1 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.0.1 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.1 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.1-rc1 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.1-rc2 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.1.1 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.1.2 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.1.3 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.1.4 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.1.5 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2-rc1 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2-rc2 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.1 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.2 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.3 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.4 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.5 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.6 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.7 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.8 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.9 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0 | No fix listed |
Show 51 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-web(Maven) | = 2.0-m1 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0-m2 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0-m3 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0-m4 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0-m5 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0-rc1 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0-rc2 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0.1 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0.2 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0.3 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0.4 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0.5 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0.6 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0.7 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0.8 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.1 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.2 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.3 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.4 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.5 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.6 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.6.SEC01 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.6.SEC02 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.6.SEC03 | No fix listed |
| org.springframework/spring-web(Maven) | = 3.0.0.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.0.1.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.0.2.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.0.3.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.0.4.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.0.5.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.0.6.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.0.7.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.1.0.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.1.1.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.1.2.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.1.3.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.1.4.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.0.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.1.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.2.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.3.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.4.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | <= 3.2.4.RELEASE | No fix listed |
| debian/libspring-java(Debian:12) | < 3.0.6.RELEASE-11 | 3.0.6.RELEASE-11 |
| debian/libspring-java(Debian:13) | < 3.0.6.RELEASE-11 | 3.0.6.RELEASE-11 |
| debian/libspring-java(Debian:14) | < 3.0.6.RELEASE-11 | 3.0.6.RELEASE-11 |
| pivotal software spring framework | >= 3.0.0, <= 3.2.4 | No fix listed |
| VMware spring framework | = 4.0.0-milestone1 | No fix listed |
| VMware spring framework | = 4.0.0-milestone2 | No fix listed |
| VMware spring framework | = 4.0.0-rc1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com patch
- github.com patch
- h20566.www2.hpe.com third-party-advisory
- jira.spring.io
- RHSA-2014:0400 third-party-advisory vendor-advisory
- 57915 third-party-advisory
- github.com
- Debian Security Tracker CVE-2013-6429 vendor-advisory
- www.gopivotal.com third-party-advisory
- 20140114 CVE-2013-6429 Fix for XML External Entity (XXE) injection (CVE-2013-4152) in Spring Framework was incomplete mailing-list third-party-advisory vdb-entry
- 64947 third-party-advisory vdb-entry
- jira.springsource.org third-party-advisory vendor-advisory
- bugs.debian.org issue-tracking