| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework:spring-oxm | < 3.2.4.RELEASE | 3.2.4.RELEASE |
| spring framework | = 3.0.0= 3.0.0.m1= 3.0.0.m2= 3.0.1= 3.0.2= 3.0.3= 3.0.4= 3.0.5 | |
| spring framework | = 3.0.6= 3.0.7= 3.1.0= 3.1.1= 3.1.2= 3.1.3= 3.1.4= 3.2.0= 3.2.1= 3.2.2= 4.0.0≤ 3.2.3 |
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free