CVE-2013-7315 (Medium) detected in spring-web-3.1.1.RELEASE.jar

[mend-bolt-for-github]

CVE-2013-7315 - Medium Severity Vulnerability

Vulnerable Library - spring-web-3.1.1.RELEASE.jar

null

Path to dependency file: /MS_Demo/ksa/ksa-web-root/ksa-bd-web/pom.xml

Path to vulnerable library: /root/.m2/repository/org/springframework/spring-web/3.1.1.RELEASE/spring-web-3.1.1.RELEASE.jar,2/repository/org/springframework/spring-web/3.1.1.RELEASE/spring-web-3.1.1.RELEASE.jar

Dependency Hierarchy:

• ❌ spring-web-3.1.1.RELEASE.jar (Vulnerable Library)

Vulnerability Details

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.

Publish Date: 2014-01-23

URL: CVE-2013-7315

CVSS 2 Score Details (6.8)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2013-7315

Release Date: 2014-01-23

Fix Resolution: 3.2.4, 4.0.0.M3

---

Step up your Open Source Security Game with WhiteSource here