Fluid Attacks Database

Description

Cross-Site Request Forgery in Spring Framework The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
maven	org.springframework:spring-web	>=0 <3.2.5.release	3.2.5.release
debian 13	libspring-java	>=0 <3.0.6.release-11	3.0.6.release-11
debian 12	libspring-java	>=0 <3.0.6.release-11	3.0.6.release-11
debian 14	libspring-java	>=0 <3.0.6.release-11	3.0.6.release-11
debian 11	libspring-java	>=0 <3.0.6.release-11	3.0.6.release-11

Aliases

1. CVE-2013-64292. NVD-2013-64293. OSV-2013-64294. OSV-DEBIAN-2013-64295. GCVE-2013-64296. SECURITY-TRACKER-CVE-2013-6429

References

1. https://github.com/spring-projects/spring-framework/issues/157042. https://github.com/spring-projects/spring-framework/commit/2ae6a6a3415eebc57babcb9d3e5505887eda6d83. https://github.com/spring-projects/spring-framework/commit/7387cb990e35b0f1b573faf29d4f9ae183d7a5e4. https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c053247555. https://jira.spring.io/browse/SPR-11078?redirect=false6. http://rhn.redhat.com/errata/RHSA-2014-0400.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.