CVSS: 8.8EPSS: 0%CPEs: 34EXPL: 0CVE-2014-0225 – Framework: Information disclosure via SSRF
https://notcve.org/view.php?id=CVE-2014-0225
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack. Al procesar un documento XML proporcionado por el usuario, el Framework Spring, versiones de la 4.0.0 a la 4.0.4 y de la 3.0.0 a la 3.2.8 y otras versiones anteriores ya no soportadas, no desactiva por defecto la resolución de las referencias URI en una declaración DTD, lo que habilita ataques de tipo XXE. It was found that the Spring Framework did not, by default, disable the resolution of URI references in a DTD declaration when processing user-provided XML documents. By observing differences in response times, an attacker could identify valid IP addresses on the internal network with functioning web servers. • https://pivotal.io/security/cve-2014-0225 https://access.redhat.com/security/cve/CVE-2014-0225 https://bugzilla.redhat.com/show_bug.cgi?id=1110110 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.8EPSS: 25%CPEs: 34EXPL: 0CVE-2014-0054 – Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429
https://notcve.org/view.php?id=CVE-2014-0054
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429. Jaxb2RootElementHttpMessageConverter en Spring MVC en Spring Framework anterior a 3.2.8 y 4.0.0 anterior a 4.0.2 no deshabilita resolución de entidad externa, lo que permite a atacantes remotos leer archivos arbitrarios, causar una denegación de servicio y realizar ataques CSRF a través de XML manipulado, también conocido como un problema de entidad externa XML (XXE). NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2013-4152, CVE-2013-7315 y CVE-2013-6429. • http://rhn.redhat.com/errata/RHSA-2014-0400.html http://secunia.com/advisories/57915 http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html http://www.securityfocus.com/bid/66148 https://jira.spring.io/browse/SPR-11376 https://access.redhat.com/security/cve/CVE-2014-0054 https://bugzilla.redhat.com/show_bug.cgi?id=1075328 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.8EPSS: 0%CPEs: 28EXPL: 1CVE-2013-7315
https://notcve.org/view.php?id=CVE-2013-7315
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions. El Spring MVC en Spring Framework anterior a 3.2.4 y 4.0.0.M1 hasta 4.0.0.M2 no desactiva la resolución de entidades externas para la StAX XMLInputFactory, que permite a atacantes dependientes de contexto para leer archivos arbitrarios, provocar una denegación de servicio, y llevar a cabo ataques CSRF través de XML manipulado con JAXB, también conocido como un problema XML External Entity (XXE) , y una vulnerabilidad diferente a CVE-2013-4152. NOTA: este problema se separó de CVE-2013-4152, debido a las diferentes versiones afectadas. • http://seclists.org/bugtraq/2013/Aug/154 http://seclists.org/fulldisclosure/2013/Nov/14 http://www.debian.org/security/2014/dsa-2842 http://www.gopivotal.com/security/cve-2013-4152 http://www.securityfocus.com/bid/77998 https://jira.springsource.org/browse/SPR-10806 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 76%CPEs: 4EXPL: 0CVE-2013-6429 – Framework: XML External Entity (XXE) injection flaw
https://notcve.org/view.php?id=CVE-2013-6429
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315. El SourceHttpMessageConverter en Spring MVC en Spring Framework antes de 3.2.5 y 4.0.0.M1 hasta 4.0.0.RC1 no desactiva resolución entidad externa, lo que permite a atacantes remotos leer archivos arbitrarios, provocar una denegación de servicio, y llevar a cabo ataques CSRF a través de un XML manipulado, también conocido como un fallo de entidades externas XML (XXE) , una vulnerabilidad diferente a CVE-2013-4152 y CVE-2013-7315. • http://rhn.redhat.com/errata/RHSA-2014-0400.html http://secunia.com/advisories/57915 http://www.gopivotal.com/security/cve-2013-6429 http://www.securityfocus.com/archive/1/530770/100/0/threaded http://www.securityfocus.com/bid/64947 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755 https://jira.springsource.org/browse/SPR-11078?page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel https://access.redhat.com/security/cve/CVE-2013- • CWE-352: Cross-Site Request Forgery (CSRF) CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.8EPSS: 93%CPEs: 27EXPL: 1CVE-2013-4152 – Framework: XML External Entity (XXE) injection flaw
https://notcve.org/view.php?id=CVE-2013-4152
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue. El wrapper Spring OXM en Spring Framework anterior a la versión 3.2.4 y 4.0.0.M1, cuando se usa el JAXB marshaller, no desactiva la resolución de entidad, lo que permite a atacantes dependientes del contexto leer archivos arbitrarios, provocar una denegación de servicio, o llevar a cabo ataques de CSRF a través de una declaración de entidad XML externa en conjunción con una referencia de entidad en (1) DOMSource, (2) StAXSource, (3) SAXSource, o (4) StreamSource, también conocido como una vulnerabilidad XXE. • http://rhn.redhat.com/errata/RHSA-2014-0212.html http://rhn.redhat.com/errata/RHSA-2014-0245.html http://rhn.redhat.com/errata/RHSA-2014-0254.html http://rhn.redhat.com/errata/RHSA-2014-0400.html http://seclists.org/bugtraq/2013/Aug/154 http://seclists.org/fulldisclosure/2013/Nov/14 http://secunia.com/advisories/56247 http://secunia.com/advisories/57915 http://www.debian.org/security/2014/dsa-2842 http://www.gopivotal.com/security/cve-2013-4152 http://w • CWE-264: Permissions, Privileges, and Access Controls •