CVE-2013-7315

State: Published
Severity: Not scored
Published: Jan 23, 2014
Updated: Aug 6, 2024
Reserved: Jan 23, 2014

Description

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

http://www.gopivotal.com/security/cve-2013-4152
20131102 XXE Injection in Spring Frameworkmailing-list
20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Frameworkmailing-list
DSA-2842vendor-advisory
77998vdb-entry
https://jira.springsource.org/browse/SPR-10806

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.