CVE-2013-6429
Cross-Site Request Forgery in Spring Framework
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
Exploit likelihood
What each source reports
NVD Score used
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
- Record
CVE-2013-6429- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352, CWE-611
- Updated
- 2026-11-02
CVE List No score
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
- Record
CVE-2013-6429- Updated
- 2026-11-02
EUVDEUVD-2022-3904 No score
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
- Record
EUVD-2022-3904- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g6hf-f9cq-q7w7 No score
Cross-Site Request Forgery in Spring Framework
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
- Record
GHSA-g6hf-f9cq-q7w7- Weakness
- CWE-352
- Updated
- 2026-11-02
OSVCLSA-2025-1760313986 No score
TuxCare security update for org.springframework (29 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 29 CVEs. Fixed in 3.1.1.RELEASE-tuxcare.1.
- Record
CLSA-2025-1760313986- Updated
- 2026-11-02
OSVCLSA-2026-1781139197 No score
TuxCare security update for org.springframework:spring-web (1 CVE)
TuxCare rebuilt org.springframework:spring-web to address 1 CVE. Fixed in 3.0.5.RELEASE-tuxcare.5.
- Record
CLSA-2026-1781139197- Updated
- 2026-11-02
Show 5 moreShow less
OSV No score
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
- Record
CVE-2013-6429- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-6429 No score
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
- Record
DEBIAN-CVE-2013-6429- Updated
- 2026-11-02
OSVGHSA-g6hf-f9cq-q7w7 No score
Cross-Site Request Forgery in Spring Framework
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
- Record
GHSA-g6hf-f9cq-q7w7- Weakness
- CWE-352
- Updated
- 2026-11-02
OSVMGASA-2014-0096 No score
Updated springframework package fixes security vulnerabilities
It was discovered by the Spring development team that the fix for the XML External Entity (XXE) Injection (CVE-2013-4152) in the Spring Framework was incomplete. Spring MVC's SourceHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them. SourceHttpMessageConverter has been modified to provide an option to control the processing of XML external entities and that processing is now disabled by default (CVE-2013-6429).
In addition Jon Passki discovered a possible XSS vulnerability: The JavaScriptUtils.javaScriptEscape() method did not escape all characters that are sensitive within either a JS single quoted string, JS double quoted string, or HTML script data context. In most cases this will result in an unexploitable parse error but in some cases it could result in an XSS vulnerability (CVE-2013-6430).
- Record
MGASA-2014-0096- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-6429 No score
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
- Record
UBUNTU-CVE-2013-6429- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-webMaven |
through 3.2.4.RELEASE | 3.2.5.RELEASE |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-oxmTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.5, plus listed versions 3.0.5.RELEASE-tuxcare.13.0.5.RELEASE-tuxcare.23.0.5.RELEASE-tuxcare.33.0.5.RELEASE-tuxcare.4 |
3.0.5.RELEASE-tuxcare.5 |
libspring-javaDebian:12 |
before 3.0.6.RELEASE-11 | 3.0.6.RELEASE-11 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libspring-javaDebian:13 |
before 3.0.6.RELEASE-11 | 3.0.6.RELEASE-11 |
libspring-javaDebian:14 |
before 3.0.6.RELEASE-11 | 3.0.6.RELEASE-11 |
libspring-javaDebian:7 From an advisory covering 2 CVEs |
before 3.0.6.RELEASE-6+deb7u2, plus listed versions 3.0.6.RELEASE-63.0.6.RELEASE-6+deb7u1 |
3.0.6.RELEASE-6+deb7u2 |
org.springframework:spring-webMaven |
before 3.2.5.RELEASE, plus listed versions 1.01.0-rc11.0.11.11.1-rc1 Show 45 moreShow less1.1-rc21.1.11.1.21.1.31.1.41.1.51.21.2-rc11.2-rc21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.92.02.0-m12.0-m22.0-m32.0-m42.0-m52.0-rc12.0-rc22.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.52.5.12.5.22.5.32.5.42.5.52.5.62.5.6.SEC012.5.6.SEC022.5.6.SEC033.0.0.RELEASE |
3.2.5.RELEASE |
springframeworkMageia:3 From an advisory covering 2 CVEs |
before 3.1.1-21.2.mga3 | 3.1.1-21.2.mga3 |
springframeworkMageia:4 From an advisory covering 2 CVEs |
before 3.1.4-2.1.mga4 | 3.1.4-2.1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| affected | OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-6429 is a medium vulnerability (CVSS 6.8) in Pivotal Software Spring Framework, published January 26, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 90.6%, the 99th percentile. Fixed in org.springframework:spring-web 3.2.5.RELEASE.
References
securityfocus.com/archive/1/530770/100/0/threaded
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
jira.springsource.org/browse/SPR-11078?page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel
gopivotal.com/security/cve-2013-6429
rhn.redhat.com/errata/RHSA-2014-0400.html
Show 13 moreShow less
secunia.com/advisories/57915
nvd.nist.gov/vuln/detail/CVE-2013-6429
github.com/spring-projects/spring-framework/issues/15704
jira.spring.io/browse/SPR-11078?redirect=false
security-tracker.debian.org/tracker/CVE-2013-6429
advisories.mageia.org/MGASA-2014-0096.html
bugs.mageia.org/show_bug.cgi?id=12707
debian.org/security/2014/dsa-2857
ubuntu.com/security/CVE-2013-6429
cve.org/CVERecord?id=CVE-2013-6429
Left out here: 17 versions. The JSON record has them.