CVE-2013-6429
No CVSS score yet. EPSS 91% chance of exploitation in the next 30 days. Fixed in org.springframework:spring-web 3.2.5.RELEASE.
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
- EPSS
- 91% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-352, CWE-611
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pivotal_software:spring_framework
- vmware:spring_framework
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-g6hf-f9cq-q7w7 | Maven | org.springframework:spring-web | <3.2.5.RELEASE | 3.2.5.RELEASE |