GHSA-vp63-rrcm-9mph

Suggest an improvement
Source
https://github.com/advisories/GHSA-vp63-rrcm-9mph
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vp63-rrcm-9mph/GHSA-vp63-rrcm-9mph.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-vp63-rrcm-9mph
Aliases
Published
2022-05-13T01:02:38Z
Modified
2024-12-04T06:07:37.800153Z
Summary
Missing XML Validation in Spring Framework
Details

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.

Database specific 
{
    "nvd_published_at": "2014-01-23T21:55:00Z",
    "cwe_ids": [
        "CWE-112"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-07T23:18:12Z"
}
References

Affected packages

Maven / org.springframework:spring-oxm

Package

Name
org.springframework:spring-oxm
View open source insights on deps.dev
Purl
pkg:maven/org.springframework/spring-oxm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.4.RELEASE

Affected versions

3.*

3.0.0.RELEASE
3.0.1.RELEASE
3.0.2.RELEASE
3.0.3.RELEASE
3.0.4.RELEASE
3.0.5.RELEASE
3.0.6.RELEASE
3.0.7.RELEASE
3.1.0.RELEASE
3.1.1.RELEASE
3.1.2.RELEASE
3.1.3.RELEASE
3.1.4.RELEASE
3.2.0.RELEASE
3.2.1.RELEASE
3.2.2.RELEASE
3.2.3.RELEASE

Database specific 

{
    "last_known_affected_version_range": "<= 3.2.3.RELEASE"
}