CVE-2013-4152
Cross-Site Request Forgery in Spring Framework
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
Exploit likelihood
What each source reports
NVD Score used
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
- Record
CVE-2013-4152- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
- Record
CVE-2013-4152- Updated
- 2026-11-02
EUVDEUVD-2022-5203 No score
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
- Record
EUVD-2022-5203- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rp4p-g69r-438x No score
Cross-Site Request Forgery in Spring Framework
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
- Record
GHSA-rp4p-g69r-438x- Weakness
- CWE-352
- Updated
- 2026-11-02
OSVCLSA-2025-1760313986 No score
TuxCare security update for org.springframework (29 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 29 CVEs. Fixed in 3.1.1.RELEASE-tuxcare.1.
- Record
CLSA-2025-1760313986- Updated
- 2026-11-02
OSVCLSA-2026-1780620680 No score
TuxCare security update for org.springframework:spring-oxm (1 CVE)
TuxCare rebuilt org.springframework:spring-oxm to address 1 CVE. Fixed in 3.0.5.RELEASE-tuxcare.3.
- Record
CLSA-2026-1780620680- Updated
- 2026-11-02
Show 5 moreShow less
OSV No score
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
- Record
CVE-2013-4152- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4152 No score
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
- Record
DEBIAN-CVE-2013-4152- Updated
- 2026-11-02
OSVGHSA-rp4p-g69r-438x No score
Cross-Site Request Forgery in Spring Framework
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
- Record
GHSA-rp4p-g69r-438x- Weakness
- CWE-352
- Updated
- 2026-11-02
OSVMGASA-2014-0042 No score
Updated springframework packages fix CVE-2013-4152
Updated springframework packages fix security vulnerability:
Alvaro Munoz discovered a XML External Entity (XXE) injection in the Spring Framework which can be used for conducting CSRF and DoS attacks on other sites (CVE-2013-4152).
- Record
MGASA-2014-0042- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4152 No score
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
- Record
UBUNTU-CVE-2013-4152- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-oxmMaven |
through 3.2.3.RELEASE | 3.2.4.RELEASE |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-oxmTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-oxmTuxCare:Maven |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.3, plus listed versions 3.0.5.RELEASE-tuxcare.13.0.5.RELEASE-tuxcare.2 |
3.0.5.RELEASE-tuxcare.3 |
libspring-javaDebian:12 |
before 3.0.6.RELEASE-10 | 3.0.6.RELEASE-10 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libspring-javaDebian:13 |
before 3.0.6.RELEASE-10 | 3.0.6.RELEASE-10 |
libspring-javaDebian:14 |
before 3.0.6.RELEASE-10 | 3.0.6.RELEASE-10 |
libspring-javaDebian:7 From an advisory covering 2 CVEs |
before 3.0.6.RELEASE-6+deb7u1, plus listed versions 3.0.6.RELEASE-6 |
3.0.6.RELEASE-6+deb7u1 |
org.springframework:spring-oxmMaven |
before 3.2.4.RELEASE, plus listed versions 3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE Show 12 moreShow less3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.2.RELEASE3.2.3.RELEASE |
3.2.4.RELEASE |
springframeworkMageia:3 |
before 3.1.1-21.1.mga3 | 3.1.1-21.1.mga3 |
activemqRed Hat:openshift:2.0::el6 From an advisory covering 4 CVEs |
before 0:5.9.0-4.redhat.610328.el6op | 0:5.9.0-4.redhat.610328.el6op |
activemq-clientRed Hat:openshift:2.0::el6 From an advisory covering 4 CVEs |
before 0:5.9.0-4.redhat.610328.el6op | 0:5.9.0-4.redhat.610328.el6op |
activemqRed Hat:openshift:1.2::el6 From an advisory covering 4 CVEs |
before 0:5.9.0-4.redhat.610328.el6op | 0:5.9.0-4.redhat.610328.el6op |
activemq-clientRed Hat:openshift:1.2::el6 From an advisory covering 4 CVEs |
before 0:5.9.0-4.redhat.610328.el6op | 0:5.9.0-4.redhat.610328.el6op |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| affected | OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4152 is a medium vulnerability (CVSS 6.8) in Springsource Spring Framework, published January 13, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 25.6%, the 97th percentile. Fixed in org.springframework:spring-oxm 3.2.4.RELEASE.
References
github.com/spring-projects/spring-framework/pull/317/files
gopivotal.com/security/cve-2013-4152
securityfocus.com/bid/61951
seclists.org/fulldisclosure/2013/Nov/14
rhn.redhat.com/errata/RHSA-2014-0254.html
Show 38 moreShow less
debian.org/security/2014/dsa-2842
secunia.com/advisories/57915
jira.springsource.org/browse/SPR-10806
nvd.nist.gov/vuln/detail/CVE-2013-4152
security-tracker.debian.org/tracker/CVE-2013-4152
advisories.mageia.org/MGASA-2014-0042.html
bugs.mageia.org/show_bug.cgi?id=12295
access.redhat.com/errata/RHSA-2014:0245
bugzilla.redhat.com/show_bug.cgi?id=958618
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0245.json
cve.org/CVERecord?id=CVE-2013-2035
camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc
ubuntu.com/security/CVE-2013-4152