NVD

Id
39809  
Name
CVE-2013-4152  
Description
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2014-01-23  
Modified Date
2016-11-28  
Seq
2013-4152  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
202491 39809 CVE-2013-4152 RHSA-2014:0212  View
202492 39809 CVE-2013-4152 RHSA-2014:0245  View
202493 39809 CVE-2013-4152 RHSA-2014:0254  View
202494 39809 CVE-2013-4152 RHSA-2014:0400  View
202495 39809 CVE-2013-4152 20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework  View
202496 39809 CVE-2013-4152 20131102 XXE Injection in Spring Framework  View
202497 39809 CVE-2013-4152 DSA-2842  View
202498 39809 CVE-2013-4152 http://www.gopivotal.com/security/cve-2013-4152  View
202499 39809 CVE-2013-4152 61951  View
202500 39809 CVE-2013-4152 https://github.com/spring-projects/spring-framework/pull/317/files  View
202501 39809 CVE-2013-4152 https://jira.springsource.org/browse/SPR-10806  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
24335 JVNDB-2013-005910 Spring Framework の Spring OXM ラッパーにおける任意のファイルを読まれる脆弱性 Spring Framework の Spring OXM ラッパーは、JAXB marshaller を使用する場合、エンティティ解決を無効にしないため、任意のファイルを読まれる、サービス運用妨害 (DoS) 状態にされる、およびクロスサイトリクエストフォージェリ攻撃を実行される脆弱性が存在します。 CVE-2013-4152 64094 CVE-2013-4152 39809 6.8 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005910.html 2013-08-22 2015-08-11 View