Spring Framework CVE-2013-4152 Multiple XML External Entity Injection Vulnerabilities

Bugtraq ID:	61951
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-4152
Remote:	Yes
Local:	No
Published:	Aug 22 2013 12:00AM
Updated:	Oct 26 2016 09:09AM
Credit:	Alvaro Munoz of the HP Enterprise Security Team.
Vulnerable:	Redhat OpenShift Enterprise 2 Redhat OpenShift Enterprise 1 Redhat JBoss SOA Platform 5.3.1 Redhat JBoss Fuse 6.0.0 Redhat JBoss A-MQ 6.0.0 IBM Websphere Portal 8.5 IBM Websphere Portal 8.0 IBM Websphere Portal 8.0.0.1 GoPivotal Spring Framework (Spring OXM) 4.0.0.M1 GoPivotal Spring Framework (Spring OXM) 3.2.3 GoPivotal Spring Framework (Spring OXM) 3.0.0 GoPivotal Spring Framework (Spring MVC) 4.0.0.M2 GoPivotal Spring Framework (Spring MVC) 4.0.0.M1 GoPivotal Spring Framework (Spring MVC) 3.2.3 GoPivotal Spring Framework (Spring MVC) 3.0.0 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	Redhat JBoss Fuse 6.1.0 Redhat JBoss A-MQ 6.1.0 GoPivotal Spring Framework (Spring OXM) 4.0.0.M2 GoPivotal Spring Framework (Spring OXM) 3.2.4 GoPivotal Spring Framework (Spring MVC) 4.0.0.RC1 GoPivotal Spring Framework (Spring MVC) 3.2.4

Spring Framework CVE-2013-4152 Multiple XML External Entity Injection Vulnerabilities

Spring Framework is prone to multiple XML External Entity injection vulnerabilities.

Attackers can exploit these issues to obtain potentially sensitive information. This may lead to further attacks.

The following versions are vulnerable:

Spring OXM 3.0.0 through 3.2.3 and 4.0.0.M1
Spring MVC 3.0.0 through 3.2.3, 4.0.0.M1 and 4.0.0.M2

Spring Framework CVE-2013-4152 Multiple XML External Entity Injection Vulnerabilities

An attacker can exploit these issues using a web browser.

Spring Framework CVE-2013-4152 Multiple XML External Entity Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Spring Framework CVE-2013-4152 Multiple XML External Entity Injection Vulnerabilities

References:

• CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework (Gopivotal)
  
• Spring Framework Homepage (Spring)
  
• Red Hat JBoss A-MQ 6.1.0 update (Red Hat)
  
• Red Hat JBoss Fuse 6.1.0 update (Red Hat)
  
• swg21989676: Security Bulletin: Security Vulnerabilities in Spring Framework aff (IBM)