← back
CVE-2013-6429

CVE-2013-6429

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 90%
exploitation probability
90%top 1% of all CVEs
observed exploitation
nono source reports it
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
Affected products
n/a · n/a
References
http://rhn.redhat.com/errata/RHSA-2014-0400.htmlhttp://secunia.com/advisories/57915https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755https://jira.springsource.org/browse/SPR-11078?page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanelhttp://www.gopivotal.com/security/cve-2013-6429http://www.securityfocus.com/archive/1/530770/100/0/threadedhttp://www.securityfocus.com/bid/64947