CVE-2013-6429

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-352 CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2014-0400.htmlThird Party Advisory
http://secunia.com/advisories/57915Third Party Advisory
http://www.gopivotal.com/security/cve-2013-6429Third Party Advisory
http://www.securityfocus.com/archive/1/530770/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/64947Third Party Advisory, VDB Entry
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755Third Party Advisory
https://jira.springsource.org/browse/SPR-11078?page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanelThird Party Advisory, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-0400.htmlThird Party Advisory
http://secunia.com/advisories/57915Third Party Advisory
http://www.gopivotal.com/security/cve-2013-6429Third Party Advisory
http://www.securityfocus.com/archive/1/530770/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/64947Third Party Advisory, VDB Entry
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755Third Party Advisory
https://jira.springsource.org/browse/SPR-11078?page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanelThird Party Advisory, Vendor Advisory

Timeline

Published: Jan 26, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-64305.4The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properl CVE-2013-64314.7The fib6_add function in net/ipv6/ip6_fib.c in the Linux kernel before 3.11.5 does not properly implement error-code encoding, which allows CVE-2013-64324.6The ping_recvmsg function in net/ipv4/ping.c in the Linux kernel before 3.12.4 does not properly interact with read system calls on ping soc CVE-2013-64337.6The default configuration in the Red Hat openstack-neutron package before 2013.2.3-7 does not properly set a configuration file for rootwrap CVE-2013-64344.3The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a native SPICE client invocation method, init CVE-2013-64357.6Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extract CVE-2013-64362.1The lxcDomainGetMemoryParameters method in lxc/lxc_driver.c in libvirt 1.0.5 through 1.2.0 does not properly check the status of LXC guests CVE-2013-64374.0The libvirt driver in OpenStack Compute (Nova) before 2013.2.2 and icehouse before icehouse-2 allows remote authenticated users to cause a d CVE-2013-64385.0The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespa CVE-2013-64399.3Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not speci CVE-2013-64405.0The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set t CVE-2013-64417.2The lxc-sshd template (templates/lxc-sshd.in) in LXC before 1.0.0.beta2 uses read-write permissions when mounting /sbin/init, which allows l