CVE-2013-4152
No CVSS score yet. EPSS 26% chance of exploitation in the next 30 days. Fixed in org.springframework:spring-oxm 3.2.4.RELEASE.
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
- EPSS
- 26% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- springsource:spring_framework
- vmware:spring_framework
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rp4p-g69r-438x | Maven | org.springframework:spring-oxm | <3.2.4.RELEASE | 3.2.4.RELEASE |