CVE-2013-7315
No CVSS score yet. EPSS 5.1% chance of exploitation in the next 30 days. Fixed in org.springframework:spring-oxm 3.2.4.RELEASE.
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
- EPSS
- 5.1% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- springsource:spring_framework
- vmware:spring_framework
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vp63-rrcm-9mph | Maven | org.springframework:spring-oxm | <3.2.4.RELEASE | 3.2.4.RELEASE |