PT-2014-2746 · Spring · Spring Framework

Poutsma · Publicado 2014-01-23 · Atualizado 2022-05-13 · CVE-2013-4152

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Spring Framework versions prior to 3.2.4 Spring Framework versions prior to 4.0.0.M1

Description The issue allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a DOMSource, StAXSource, SAXSource, or StreamSource, also known as an XML External Entity (XXE) issue.

Recommendations For Spring Framework versions prior to 3.2.4, update to version 3.2.4 or later to resolve the issue. For Spring Framework versions prior to 4.0.0.M1, update to version 4.0.0.M1 or later to resolve the issue.

Exploit

Correção

DoS

CSRF

Enumeração de Fraquezas

CWE-352

CWE-264

Identificadores relacionados

CVE-2013-4152

DSA-2842-1

GHSA-RP4P-G69R-438X

MGASA-2014-0042

RHSA-2014:0245

RHSA-2014:0254

Produtos afetados

Spring Framework

Referências · 28

• 🔥 https://jira.springsource.org/browse/SPR-10806 · Exploit
• https://github.com/spring-projects/spring-framework/pull/317/files · Correção
• https://github.com/spring-projects/spring-framework/commit/434735fbf6e7f9051af2ef027657edb99120b173 · Nota
• https://github.com/spring-projects/spring-framework/commit/7576274874deeccb6da6b09a8d5bd62e8b5538b7 · Nota
• https://ubuntu.com/security/CVE-2013-4152 · Aviso do Fabricante
• http://securityfocus.com/bid/61951 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4152 · Nota
• https://security-tracker.debian.org/tracker/CVE-2013-4152 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4152 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2013-4152 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2014-0400.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-4152 · Nota de Segurança
• http://seclists.org/fulldisclosure/2013/Nov/14 · Nota
• http://rhn.redhat.com/errata/RHSA-2014-0254.html · Aviso do Fabricante
• http://debian.org/security/2014/dsa-2842 · Aviso do Fabricante