Login Request a demo
Unscored severity · published Jan 26, 2014
CVE-2013-6429
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote…
–
CVSS
90.6%
EPSS
No
On KEV
Description
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
Exploitation
Is it being used?
Exploit prediction (EPSS)90.6% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Spring Framework · Pivotal Software
3.0.0 through 3.2.4 · source: NVD
Affected product
SF
Spring Framework
Pivotal Software
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-6429
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-6429
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-0400.html
Third Party Advisory
http://secunia.com/advisories/57915
Third Party Advisory
http://www.gopivotal.com/security/cve-2013-6429
Third Party Advisory
http://www.securityfocus.com/archive/1/530770/100/0/threaded
Third Party Advisory
http://www.securityfocus.com/bid/64947
Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
More from Spring Framework
8.8
CVE-2014-0225
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the…
7.5
CVE-2016-5007
Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers…
7.5
CVE-2016-9878
An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5
5.5
CVE-2015-3192
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to…
5.4
CVE-2013-6430
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which…