Cross-site request forgery In org.springframework:spring-oxm
Description
Cross-Site Request Forgery in Spring Framework The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 3.2.4.release | ||
 debian 12 | 3.0.6.release-10 | ||
debian 14 | 3.0.6.release-10 | ||
debian 11 | 3.0.6.release-10 | ||
debian 13 | 3.0.6.release-10 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11.