CVE-2013-6429

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 90.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-01-26 · updated 2026-06-17
Weakness: CWE-352

Description

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.

Affected products

Spring Framework: from 3.0.0 through 3.2.4
Spring Framework: 4.0.0-milestone1, 4.0.0-milestone2, 4.0.0-rc1

References

http://rhn.redhat.com/errata/RHSA-2014-0400.html
http://secunia.com/advisories/57915
http://www.gopivotal.com/security/cve-2013-6429
http://www.securityfocus.com/archive/1/530770/100/0/threaded
http://www.securityfocus.com/bid/64947
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
https://jira.springsource.org/browse/SPR-11078?page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel
http://rhn.redhat.com/errata/RHSA-2014-0400.html
http://secunia.com/advisories/57915
http://www.gopivotal.com/security/cve-2013-6429
http://www.securityfocus.com/archive/1/530770/100/0/threaded
http://www.securityfocus.com/bid/64947

Get alerted when CVE-2013-6429 or the next vulnerability affects your stack