{"id":"CVE-2013-4152","published":"2014-01-23T21:00:00Z","modified":"2024-08-06T16:30:49Z","title":"The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable…","vendor":null,"product":null,"tier":"tail","description":{"text":"The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.25634,"percentile":0.97954,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/spring-projects/spring-framework/pull/317/files","tags":["x_refsource_CONFIRM"]},{"url":"http://www.gopivotal.com/security/cve-2013-4152","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/61951","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://seclists.org/fulldisclosure/2013/Nov/14","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0254.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://seclists.org/bugtraq/2013/Aug/154","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.debian.org/security/2014/dsa-2842","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0212.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0400.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0245.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://secunia.com/advisories/57915","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://jira.springsource.org/browse/SPR-10806","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/56247","tags":["third-party-advisory","x_refsource_SECUNIA"]}],"priority":{"score":19.6,"factors":[{"name":"EPSS percentile","points":19.59}]},"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-oxm","vulnerableRanges":["<3.2.4.RELEASE"],"patched":["3.2.4.RELEASE"],"from":["GHSA-rp4p-g69r-438x"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5203","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-org-springframework-spring-oxm-cve-2013-4152","children":[{"from":"CVE-2013-4152","to":"CVE-2014-0054","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.","from":"CVE.org","in":"CVE-2014-0054"},{"kind":"same-code","provenance":"machine","files":["spring-web/src/main/java/org/springframework/http/converter/xml/Jaxb2CollectionHttpMessageConverter.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/434735fbf6e7f9051af2ef027657edb99120b173","https://github.com/spring-projects/spring-framework/commit/7576274874deeccb6da6b09a8d5bd62e8b5538b7","https://github.com/spring-projects/spring-framework/commit/1a8629d40825c073b6863ae2ab748b647b28506a","https://github.com/spring-projects/spring-framework/commit/1c5cab2a4069ec3239c531d741aeb07a434f521b"],"basis":"shared function","functions":["writeToResult"]}]},{"from":"CVE-2013-4152","to":"CVE-2023-37364","relation":"related","confidence":"low","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"This allows context-dependent attackers to read arbitrary files or cause a denial of service, a similar issue to CVE-2013-4152.","from":"CVE.org","in":"CVE-2023-37364"}]}]}}