CVE-2013-4152

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows…

published January 23, 2014

CVSS

—

EPSS

26%

Percentile

97.9

In the wild

Unconfirmed

What it is

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.25634 · 97.9th percentile
Published: 2014-01-23T21:00Z

EPSS history

Timeline

23 JAN 21:00Z
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows…
cvelistv5