Read the docs
TI-2013-03625 Aliases CVE-2013-4152GHSA-rp4p-g69r-438x

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB…

Priority MEDIUM 52CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Security bypass, Tampering
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-264 and CWE-352.

Summary

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.

Why it matters now

EPSS 0.25634 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.springframework:spring-oxm (Maven): 3.2.4.RELEASERed Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.springframework:spring-oxm (Maven)before 3.2.4.RELEASE3.2.4.RELEASEPatch availableGHSA-rp4p-g69r-438x
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.springframework:spring-oxm (Maven) Vendor— Affected before 3.2.4.RELEASE Fixed in 3.2.4.RELEASE Patch available GHSA-rp4p-g69r-438x

CPE configurations NVD · 27

CPEVersionsRoleVendor
cpe:2.3:a:springsource:spring_framework:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:m1:*:*:*:*:*:*3.0.0 m1VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:m2:*:*:*:*:*:*3.0.0 m2VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:m3:*:*:*:*:*:*3.0.0 m3VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:m4:*:*:*:*:*:*3.0.0 m4VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:rc1:*:*:*:*:*:*3.0.0 rc1VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:rc2:*:*:*:*:*:*3.0.0 rc2VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:rc3:*:*:*:*:*:*3.0.0 rc3VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0.m1:*:*:*:*:*:*:*3.0.0.m1VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0.m2:*:*:*:*:*:*:*3.0.0.m2VulnerableSpringsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:m1:*:*:*:*:*:* Versions 3.0.0 m1 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:m2:*:*:*:*:*:* Versions 3.0.0 m2 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:m3:*:*:*:*:*:* Versions 3.0.0 m3 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:m4:*:*:*:*:*:* Versions 3.0.0 m4 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:rc1:*:*:*:*:*:* Versions 3.0.0 rc1 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:rc2:*:*:*:*:*:* Versions 3.0.0 rc2 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:rc3:*:*:*:*:*:* Versions 3.0.0 rc3 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0.m1:*:*:*:*:*:*:* Versions 3.0.0.m1 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0.m2:*:*:*:*:*:*:* Versions 3.0.0.m2 Vulnerable ·Springsource
Show 17 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:springsource:spring_framework:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.4:*:*:*:*:*:*:*3.0.4VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.5:*:*:*:*:*:*:*3.0.5VulnerableSpringsource
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*up to 3.2.3VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.0.6:*:*:*:*:*:*:*3.0.6VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.0.7:*:*:*:*:*:*:*3.0.7VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.3:*:*:*:*:*:*:*3.1.3VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.4:*:*:*:*:*:*:*3.1.4VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.2:*:*:*:*:*:*:*3.2.2VulnerableVMware
cpe:2.3:a:vmware:spring_framework:4.0.0:milestone1:*:*:*:*:*:*4.0.0 milestone1VulnerableVMware
  • cpe:2.3:a:springsource:spring_framework:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·Springsource
  • cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions up to 3.2.3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.0.6:*:*:*:*:*:*:* Versions 3.0.6 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.0.7:*:*:*:*:*:*:* Versions 3.0.7 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.3:*:*:*:*:*:*:* Versions 3.1.3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.4:*:*:*:*:*:*:* Versions 3.1.4 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:4.0.0:milestone1:*:*:*:*:*:* Versions 4.0.0 milestone1 Vulnerable ·VMware

Remediation

  • Fix · GHSA-rp4p-g69r-438x org.springframework:spring-oxm (Maven) Fixed in 3.2.4.RELEASE Advisory →

Red Hat 5 advisories

  • RHSA-2014:0400 Released 2014-04-14 · Red Hat rating Moderate
    Red Hat JBoss Fuse 6.1.0 update
    • Red Hat JBoss Fuse 6.1
  • RHSA-2014:0401 Released 2014-04-14 · Red Hat rating Moderate
    Red Hat JBoss A-MQ 6.1.0 update
    • Red Hat JBoss A-MQ 6.1
  • RHSA-2014:0254 Released 2014-03-05 · Red Hat rating Important
    activemq security update
    • RHOSE Infrastructure 1.2 activemq-5.9.0-4.redhat.610328.el6op, activemq-client-5.9.0-4.redhat.610328.el6op
    • Red Hat OpenShift Enterprise Node activemq-5.9.0-4.redhat.610328.el6op, activemq-client-5.9.0-4.redhat.610328.el6op
Show 2 more Red Hat advisories
  • RHSA-2014:0245 Released 2014-03-03 · Red Hat rating Important
    activemq security update
    • RHOSE Infrastructure 2.0 activemq-5.9.0-4.redhat.610328.el6op, activemq-client-5.9.0-4.redhat.610328.el6op
    • RHOSE Node 2.0 activemq-5.9.0-4.redhat.610328.el6op, activemq-client-5.9.0-4.redhat.610328.el6op
  • RHSA-2014:0212 Released 2014-02-25 · Red Hat rating Moderate
    Red Hat JBoss SOA Platform 5.3.1 update
    • Red Hat JBoss SOA Platform 5.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHOSE Infrastructure 1.2Fixed RHSA-2014:0254
RHOSE Infrastructure 2.0Fixed RHSA-2014:0245
RHOSE Node 2.0Fixed RHSA-2014:0245
Red Hat JBoss A-MQ 6.1Fixed RHSA-2014:0401
Red Hat JBoss Fuse 6.1Fixed RHSA-2014:0400
Red Hat JBoss SOA Platform 5.3Fixed RHSA-2014:0212
Red Hat OpenShift Enterprise NodeFixed RHSA-2014:0254

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4152
  2. 2026-10-03 Alias added: GHSA-rp4p-g69r-438x

References

Exploit 1

Patch 1

Advisory 7

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences