PT-2014-2746 · Spring · Spring Framework

Poutsma · Published 2014-01-23 · Updated 2022-05-13 · CVE-2013-4152

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Spring Framework versions prior to 3.2.4 Spring Framework versions prior to 4.0.0.M1

Description The issue allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a DOMSource, StAXSource, SAXSource, or StreamSource, also known as an XML External Entity (XXE) issue.

Recommendations For Spring Framework versions prior to 3.2.4, update to version 3.2.4 or later to resolve the issue. For Spring Framework versions prior to 4.0.0.M1, update to version 4.0.0.M1 or later to resolve the issue.

Exploit

Fix

DoS

CSRF

Weakness Enumeration

CWE-352

CWE-264

Related Identifiers

CVE-2013-4152

DSA-2842-1

GHSA-RP4P-G69R-438X

MGASA-2014-0042

RHSA-2014:0245

RHSA-2014:0254

Affected Products

Spring Framework

References · 28

• 🔥 https://jira.springsource.org/browse/SPR-10806 · Exploit
• https://github.com/spring-projects/spring-framework/pull/317/files · Patch
• https://ubuntu.com/security/CVE-2013-4152 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-4152 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4152 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-4152 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0400.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4152 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-0254.html · Vendor Advisory
• http://debian.org/security/2014/dsa-2842 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0212.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0245.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rp4p-g69r-438x · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-4152 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0042 · Vendor Advisory