CVE-2013-7315
Missing XML Validation in Spring Framework
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
Exploit likelihood
What each source reports
NVD Score used
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
- Record
CVE-2013-7315- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
- Record
CVE-2013-7315- Updated
- 2026-11-02
EUVDEUVD-2022-5391 No score
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
- Record
EUVD-2022-5391- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vp63-rrcm-9mph No score
Missing XML Validation in Spring Framework
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
- Record
GHSA-vp63-rrcm-9mph- Weakness
- CWE-112
- Updated
- 2026-11-02
OSVCLSA-2026-1792686902 No score
TuxCare security update for org.springframework:spring-oxm (1 CVE)
TuxCare rebuilt org.springframework:spring-oxm to address 1 CVE. Fixed in 3.0.5.RELEASE-tuxcare.13.
- Record
CLSA-2026-1792686902- Updated
- 2026-11-02
OSVCLSA-2026-1792687219 No score
TuxCare security update for org.springframework:spring-oxm (1 CVE)
TuxCare rebuilt org.springframework:spring-oxm to address 1 CVE. Fixed in 3.1.1.RELEASE-tuxcare.5.
- Record
CLSA-2026-1792687219- Updated
- 2026-11-02
Show 4 moreShow less
OSV No score
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
- Record
CVE-2013-7315- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-7315 No score
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
- Record
DEBIAN-CVE-2013-7315- Updated
- 2026-11-02
OSVGHSA-vp63-rrcm-9mph No score
Missing XML Validation in Spring Framework
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
- Record
GHSA-vp63-rrcm-9mph- Weakness
- CWE-112
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-7315 No score
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
- Record
UBUNTU-CVE-2013-7315- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-oxmMaven |
through 3.2.3.RELEASE | 3.2.4.RELEASE |
org.springframework:spring-oxmTuxCare:Maven |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.13, plus listed versions 3.0.5.RELEASE-tuxcare.13.0.5.RELEASE-tuxcare.103.0.5.RELEASE-tuxcare.113.0.5.RELEASE-tuxcare.123.0.5.RELEASE-tuxcare.2 Show 7 moreShow less3.0.5.RELEASE-tuxcare.33.0.5.RELEASE-tuxcare.43.0.5.RELEASE-tuxcare.53.0.5.RELEASE-tuxcare.63.0.5.RELEASE-tuxcare.73.0.5.RELEASE-tuxcare.83.0.5.RELEASE-tuxcare.9 |
3.0.5.RELEASE-tuxcare.13 |
org.springframework:spring-oxmTuxCare:Maven |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.5, plus listed versions 3.1.1.RELEASE-tuxcare.13.1.1.RELEASE-tuxcare.23.1.1.RELEASE-tuxcare.33.1.1.RELEASE-tuxcare.4 |
3.1.1.RELEASE-tuxcare.5 |
libspring-javaDebian:12 |
before 3.0.6.RELEASE-10 | 3.0.6.RELEASE-10 |
libspring-javaDebian:13 |
before 3.0.6.RELEASE-10 | 3.0.6.RELEASE-10 |
libspring-javaDebian:14 |
before 3.0.6.RELEASE-10 | 3.0.6.RELEASE-10 |
libspring-javaDebian:7 From an advisory covering 2 CVEs |
before 3.0.6.RELEASE-6+deb7u1, plus listed versions 3.0.6.RELEASE-6 |
3.0.6.RELEASE-6+deb7u1 |
org.springframework:spring-oxmMaven |
before 3.2.4.RELEASE, plus listed versions 3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE Show 12 moreShow less3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.2.RELEASE3.2.3.RELEASE |
3.2.4.RELEASE |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-7315 is a medium vulnerability (CVSS 6.8) in Springsource Spring Framework, published January 13, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.07%, the 92nd percentile. Fixed in org.springframework:spring-oxm 3.2.4.RELEASE.
References
gopivotal.com/security/cve-2013-4152
seclists.org/fulldisclosure/2013/Nov/14
debian.org/security/2014/dsa-2842
securityfocus.com/bid/77998
jira.springsource.org/browse/SPR-10806
Show 10 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-7315
github.com/spring-projects/spring-framework/issues/15432
jira.spring.io/browse/SPR-10806?redirect=false
security-tracker.debian.org/tracker/CVE-2013-7315
ubuntu.com/security/CVE-2013-7315
bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4152
cve.org/CVERecord?id=CVE-2013-7315