CVE-2013-7315 Missing XML Validation in Spring Framework
MediumCVSS 6.8
EPSS 5.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-oxm(Maven) | < 3.2.4.RELEASE | 3.2.4.RELEASE |
| org.springframework/spring-oxm(Maven) | = 3.0.0.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.0.1.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.0.2.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.0.3.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.0.4.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.0.5.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.0.6.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.0.7.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.1.0.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.1.1.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.1.2.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.1.3.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.1.4.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.2.0.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.2.1.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.2.2.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | = 3.2.3.RELEASE | No fix listed |
| org.springframework/spring-oxm(Maven) | <= 3.2.3.RELEASE | No fix listed |
| debian/libspring-java(Debian:12) | < 3.0.6.RELEASE-10 | 3.0.6.RELEASE-10 |
| debian/libspring-java(Debian:13) | < 3.0.6.RELEASE-10 | 3.0.6.RELEASE-10 |
| debian/libspring-java(Debian:14) | < 3.0.6.RELEASE-10 | 3.0.6.RELEASE-10 |
| springsource spring framework | = 3.0.0 | No fix listed |
| springsource spring framework | = 3.0.0-m1 | No fix listed |
| springsource spring framework | = 3.0.0-m2 | No fix listed |
Show 25 more
| Product | Affected versions | Fixed in |
|---|---|---|
| springsource spring framework | = 3.0.0-m3 | No fix listed |
| springsource spring framework | = 3.0.0-m4 | No fix listed |
| springsource spring framework | = 3.0.0-rc1 | No fix listed |
| springsource spring framework | = 3.0.0-rc2 | No fix listed |
| springsource spring framework | = 3.0.0-rc3 | No fix listed |
| springsource spring framework | = 3.0.0.m1 | No fix listed |
| springsource spring framework | = 3.0.0.m2 | No fix listed |
| springsource spring framework | = 3.0.1 | No fix listed |
| springsource spring framework | = 3.0.2 | No fix listed |
| springsource spring framework | = 3.0.3 | No fix listed |
| springsource spring framework | = 3.0.4 | No fix listed |
| springsource spring framework | = 3.0.5 | No fix listed |
| VMware spring framework | <= 3.2.3 | No fix listed |
| VMware spring framework | = 3.0.6 | No fix listed |
| VMware spring framework | = 3.0.7 | No fix listed |
| VMware spring framework | = 3.1.0 | No fix listed |
| VMware spring framework | = 3.1.1 | No fix listed |
| VMware spring framework | = 3.1.2 | No fix listed |
| VMware spring framework | = 3.1.3 | No fix listed |
| VMware spring framework | = 3.1.4 | No fix listed |
| VMware spring framework | = 3.2.0 | No fix listed |
| VMware spring framework | = 3.2.1 | No fix listed |
| VMware spring framework | = 3.2.2 | No fix listed |
| VMware spring framework | = 4.0.0-milestone1 | No fix listed |
| VMware spring framework | = 4.0.0-milestone2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com patch
- github.com patch
- jira.spring.io
- 20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework mailing-list
- 20131102 XXE Injection in Spring Framework mailing-list
- DSA-2842 vendor-advisory
- 77998 vdb-entry
- github.com
- Debian Security Tracker CVE-2013-7315 vendor-advisory
- www.gopivotal.com vendor-advisory
- jira.springsource.org exploit patch
- bugs.debian.org issue-tracking