Read the docs
TI-2013-05980 Aliases CVE-2013-7315GHSA-vp63-rrcm-9mph

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not…

Priority LOW 38CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-264.

Summary

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.

Why it matters now

EPSS 0.05065 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.springframework:spring-oxm (Maven): 3.2.4.RELEASE

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.springframework:spring-oxm (Maven)before 3.2.4.RELEASE3.2.4.RELEASEPatch availableGHSA-vp63-rrcm-9mph
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.springframework:spring-oxm (Maven) Vendor— Affected before 3.2.4.RELEASE Fixed in 3.2.4.RELEASE Patch available GHSA-vp63-rrcm-9mph

CPE configurations NVD · 28

CPEVersionsRoleVendor
cpe:2.3:a:springsource:spring_framework:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:m1:*:*:*:*:*:*3.0.0 m1VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:m2:*:*:*:*:*:*3.0.0 m2VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:m3:*:*:*:*:*:*3.0.0 m3VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:m4:*:*:*:*:*:*3.0.0 m4VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:rc1:*:*:*:*:*:*3.0.0 rc1VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:rc2:*:*:*:*:*:*3.0.0 rc2VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:rc3:*:*:*:*:*:*3.0.0 rc3VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0.m1:*:*:*:*:*:*:*3.0.0.m1VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0.m2:*:*:*:*:*:*:*3.0.0.m2VulnerableSpringsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:m1:*:*:*:*:*:* Versions 3.0.0 m1 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:m2:*:*:*:*:*:* Versions 3.0.0 m2 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:m3:*:*:*:*:*:* Versions 3.0.0 m3 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:m4:*:*:*:*:*:* Versions 3.0.0 m4 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:rc1:*:*:*:*:*:* Versions 3.0.0 rc1 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:rc2:*:*:*:*:*:* Versions 3.0.0 rc2 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:rc3:*:*:*:*:*:* Versions 3.0.0 rc3 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0.m1:*:*:*:*:*:*:* Versions 3.0.0.m1 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0.m2:*:*:*:*:*:*:* Versions 3.0.0.m2 Vulnerable ·Springsource
Show 18 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:springsource:spring_framework:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.4:*:*:*:*:*:*:*3.0.4VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.5:*:*:*:*:*:*:*3.0.5VulnerableSpringsource
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*up to 3.2.3VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.0.6:*:*:*:*:*:*:*3.0.6VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.0.7:*:*:*:*:*:*:*3.0.7VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.3:*:*:*:*:*:*:*3.1.3VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.1.4:*:*:*:*:*:*:*3.1.4VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableVMware
cpe:2.3:a:vmware:spring_framework:3.2.2:*:*:*:*:*:*:*3.2.2VulnerableVMware
cpe:2.3:a:vmware:spring_framework:4.0.0:milestone1:*:*:*:*:*:*4.0.0 milestone1VulnerableVMware
cpe:2.3:a:vmware:spring_framework:4.0.0:milestone2:*:*:*:*:*:*4.0.0 milestone2VulnerableVMware
  • cpe:2.3:a:springsource:spring_framework:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·Springsource
  • cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions up to 3.2.3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.0.6:*:*:*:*:*:*:* Versions 3.0.6 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.0.7:*:*:*:*:*:*:* Versions 3.0.7 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.3:*:*:*:*:*:*:* Versions 3.1.3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.1.4:*:*:*:*:*:*:* Versions 3.1.4 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:4.0.0:milestone1:*:*:*:*:*:* Versions 4.0.0 milestone1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:4.0.0:milestone2:*:*:*:*:*:* Versions 4.0.0 milestone2 Vulnerable ·VMware

Remediation

  • Fix · GHSA-vp63-rrcm-9mph org.springframework:spring-oxm (Maven) Fixed in 3.2.4.RELEASE Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-7315
  2. 2026-10-03 Alias added: GHSA-vp63-rrcm-9mph

References

Exploit 1

Advisory 3

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences