{"id":"CVE-2013-7315","published":"2014-01-23T21:00:00Z","modified":"2024-08-06T18:01:20Z","title":"The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity…","vendor":null,"product":null,"tier":"tail","description":{"text":"The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152.  NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.05065,"percentile":0.92291,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.gopivotal.com/security/cve-2013-4152","tags":["x_refsource_CONFIRM"]},{"url":"http://seclists.org/fulldisclosure/2013/Nov/14","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://seclists.org/bugtraq/2013/Aug/154","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.debian.org/security/2014/dsa-2842","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://www.securityfocus.com/bid/77998","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://jira.springsource.org/browse/SPR-10806","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.5,"factors":[{"name":"EPSS percentile","points":18.46}]},"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-oxm","vulnerableRanges":["<3.2.4.RELEASE"],"patched":["3.2.4.RELEASE"],"from":["GHSA-vp63-rrcm-9mph"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5391","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-org-springframework-spring-oxm-cve-2013-4152","children":[{"from":"CVE-2013-7315","to":"CVE-2014-0054","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.","from":"CVE.org","in":"CVE-2014-0054"},{"kind":"same-code","provenance":"machine","files":["spring-web/src/main/java/org/springframework/http/converter/xml/Jaxb2CollectionHttpMessageConverter.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/434735fbf6e7f9051af2ef027657edb99120b173","https://github.com/spring-projects/spring-framework/commit/7576274874deeccb6da6b09a8d5bd62e8b5538b7","https://github.com/spring-projects/spring-framework/commit/1a8629d40825c073b6863ae2ab748b647b28506a","https://github.com/spring-projects/spring-framework/commit/1c5cab2a4069ec3239c531d741aeb07a434f521b"],"basis":"shared function","functions":["writeToResult"]}]}]}}