GHSA-g6hf-f9cq-q7w7
Suggest an improvement- Source
- https://github.com/advisories/GHSA-g6hf-f9cq-q7w7
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-g6hf-f9cq-q7w7/GHSA-g6hf-f9cq-q7w7.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-g6hf-f9cq-q7w7
- Aliases
- Published
- 2022-05-13T01:02:39Z
- Modified
- 2024-12-04T05:32:09.536057Z
- Summary
- Cross-Site Request Forgery in Spring Framework
- Details
-
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
- Database specific
{ "nvd_published_at": "2014-01-26T16:58:00Z", "cwe_ids": [ "CWE-352" ], "severity": "MODERATE", "github_reviewed_at": "2022-07-07T23:20:49Z", "github_reviewed": true }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2013-6429
- https://github.com/spring-projects/spring-framework/issues/15704
- https://github.com/spring-projects/spring-framework/commit/2ae6a6a3415eebc57babcb9d3e5505887eda6d8
- https://github.com/spring-projects/spring-framework/commit/7387cb990e35b0f1b573faf29d4f9ae183d7a5e
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
- https://jira.spring.io/browse/SPR-11078?redirect=false
- http://rhn.redhat.com/errata/RHSA-2014-0400.html
- http://secunia.com/advisories/57915
Affected packages
Maven / org.springframework:spring-web
Package
- Name
- org.springframework:spring-web
- View open source insights on deps.dev
- Purl
- pkg:maven/org.springframework/spring-web
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed3.2.5.RELEASE
Affected versions
1.*
1.0-rc1
1.0
1.0.1
1.1-rc1
1.1-rc2
1.1
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.2-rc1
1.2-rc2
1.2
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
2.*
2.0-m1
2.0-m2
2.0-m3
2.0-m4
2.0-m5
2.0-rc1
2.0-rc2
2.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.5
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.5.6.SEC01
2.5.6.SEC02
2.5.6.SEC03
3.*
3.0.0.RELEASE
3.0.1.RELEASE
3.0.2.RELEASE
3.0.3.RELEASE
3.0.4.RELEASE
3.0.5.RELEASE
3.0.6.RELEASE
3.0.7.RELEASE
3.1.0.RELEASE
3.1.1.RELEASE
3.1.2.RELEASE
3.1.3.RELEASE
3.1.4.RELEASE
3.2.0.RELEASE
3.2.1.RELEASE
3.2.2.RELEASE
3.2.3.RELEASE
3.2.4.RELEASE