Published: 26/01/2014 Updated: 11/04/2022

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The SourceHttpMessageConverter in Spring MVC in Spring Framework prior to 3.2.5 and 4.0.0.M1 up to and including 4.0.0.RC1 does not disable external entity resolution, which allows remote malicious users to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.

Vulnerable Product	Search on Vulmon	Subscribe to Product
vmware spring framework 4.0.0
pivotal software spring framework

Debian Bug report logs - #741604 libspring-java: Multiple security issues Package: libspring-java; Maintainer for libspring-java is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Fri, 14 Mar 2014 12:39:01 UTC Owned by: Miguel Landaeta < ...

Debian Bug report logs - #735420 libspring-java: CVE-2013-6429 CVE-2013-6430 Package: libspring-java; Maintainer for libspring-java is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Wed, 15 Jan 2014 09:36:11 UTC Owned by: Markus Koschany & ...

It was discovered by the Spring development team that the fix for the XML External Entity (XXE) Injection (CVE-2013-4152) in the Spring Framework was incomplete Spring MVC's SourceHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them SourceHttpMessageConverter has b ...

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 325 and 400M1 through 400RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability th ...

CWE-352 CWE-611 https://jira.springsource.org/browse/SPR-11078?page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel http://www.gopivotal.com/security/cve-2013-6429 http://rhn.redhat.com/errata/RHSA-2014-0400.html http://secunia.com/advisories/57915 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755 http://www.securityfocus.com/bid/64947 http://www.securityfocus.com/archive/1/530770/100/0/threaded https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741604 https://access.redhat.com/security/cve/cve-2013-6429 https://www.debian.org/security/./dsa-2857

CVE-2013-6429

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect