CVE-2013-4152
23.01.2014, 21:55
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.Enginsight
| Vendor | Product | Version |
|---|---|---|
| springsource | spring_framework | 3.0.0 |
| springsource | spring_framework | 3.0.0:m1 |
| springsource | spring_framework | 3.0.0:m2 |
| springsource | spring_framework | 3.0.0:m3 |
| springsource | spring_framework | 3.0.0:m4 |
| springsource | spring_framework | 3.0.0:rc1 |
| springsource | spring_framework | 3.0.0:rc2 |
| springsource | spring_framework | 3.0.0:rc3 |
| springsource | spring_framework | 3.0.0.m1:m1 |
| springsource | spring_framework | 3.0.0.m2:m2 |
| springsource | spring_framework | 3.0.1 |
| springsource | spring_framework | 3.0.2 |
| springsource | spring_framework | 3.0.3 |
| springsource | spring_framework | 3.0.4 |
| springsource | spring_framework | 3.0.5 |
| vmware | spring_framework | 𝑥 ≤ 3.2.3 |
| vmware | spring_framework | 3.0.6 |
| vmware | spring_framework | 3.0.7 |
| vmware | spring_framework | 3.1.0 |
| vmware | spring_framework | 3.1.1 |
| vmware | spring_framework | 3.1.2 |
| vmware | spring_framework | 3.1.3 |
| vmware | spring_framework | 3.1.4 |
| vmware | spring_framework | 3.2.0 |
| vmware | spring_framework | 3.2.1 |
| vmware | spring_framework | 3.2.2 |
| vmware | spring_framework | 4.0.0:milestone1 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
References