CVE-2013-4152

Опубликовано: 23 янв. 2014

Источник: nvd

CVSS2: 6.8

EPSS Высокий

Описание

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:springsource:spring_framework:3.0.0:*:*:*:*:*:*:*

cpe:2.3:a:springsource:spring_framework:3.0.0:m1:*:*:*:*:*:*

cpe:2.3:a:springsource:spring_framework:3.0.0:m2:*:*:*:*:*:*

cpe:2.3:a:springsource:spring_framework:3.0.0:m3:*:*:*:*:*:*

cpe:2.3:a:springsource:spring_framework:3.0.0:m4:*:*:*:*:*:*

cpe:2.3:a:springsource:spring_framework:3.0.0:rc1:*:*:*:*:*:*

cpe:2.3:a:springsource:spring_framework:3.0.0:rc2:*:*:*:*:*:*

cpe:2.3:a:springsource:spring_framework:3.0.0:rc3:*:*:*:*:*:*

cpe:2.3:a:springsource:spring_framework:3.0.0.m1:*:*:*:*:*:*:*

cpe:2.3:a:springsource:spring_framework:3.0.0.m2:*:*:*:*:*:*:*

cpe:2.3:a:springsource:spring_framework:3.0.1:*:*:*:*:*:*:*

cpe:2.3:a:springsource:spring_framework:3.0.2:*:*:*:*:*:*:*

cpe:2.3:a:springsource:spring_framework:3.0.3:*:*:*:*:*:*:*

cpe:2.3:a:springsource:spring_framework:3.0.4:*:*:*:*:*:*:*

cpe:2.3:a:springsource:spring_framework:3.0.5:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*

Версия до 3.2.3 (включая)

cpe:2.3:a:vmware:spring_framework:3.0.6:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.0.7:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.1.0:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.1.1:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.1.2:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.1.3:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.1.4:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.2.0:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.2.1:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:3.2.2:*:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_framework:4.0.0:milestone1:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.84056

Высокий

6.8 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

CVE-2013-4152

ubuntu

больше 11 лет назад

CVE-2013-4152

redhat

почти 12 лет назад

CVE-2013-4152

debian

больше 11 лет назад

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, ...

GHSA-rp4p-g69r-438x

github

около 3 лет назад

Cross-Site Request Forgery in Spring Framework

EPSS

Процентиль: 99%

0.84056

Высокий

6.8 Medium

CVSS2

Дефекты

CWE-264