Moderate severityNVD Advisory· Published Jan 26, 2014· Updated Jun 17, 2026
CVE-2013-6429
CVE-2013-6429
Description
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.springframework:spring-webMaven | < 3.2.5.RELEASE | 3.2.5.RELEASE |
Affected products
5- cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*Range: >=3.0.0,<=3.2.4
cpe:2.3:a:vmware:spring_framework:4.0.0:milestone1:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:vmware:spring_framework:4.0.0:milestone1:*:*:*:*:*:*
- cpe:2.3:a:vmware:spring_framework:4.0.0:milestone2:*:*:*:*:*:*
- cpe:2.3:a:vmware:spring_framework:4.0.0:rc1:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
13- rhn.redhat.com/errata/RHSA-2014-0400.htmlnvdThird Party AdvisoryWEB
- secunia.com/advisories/57915nvdThird Party AdvisoryWEB
- www.gopivotal.com/security/cve-2013-6429nvdThird Party Advisory
- www.securityfocus.com/archive/1/530770/100/0/threadednvdThird Party AdvisoryVDB Entry
- www.securityfocus.com/bid/64947nvdThird Party AdvisoryVDB Entry
- github.com/advisories/GHSA-g6hf-f9cq-q7w7ghsaADVISORY
- h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplaynvdThird Party AdvisoryWEB
- jira.springsource.org/browse/SPR-11078nvdThird Party AdvisoryVendor Advisory
- nvd.nist.gov/vuln/detail/CVE-2013-6429ghsaADVISORY
- github.com/spring-projects/spring-framework/commit/2ae6a6a3415eebc57babcb9d3e5505887eda6d8ghsaWEB
- github.com/spring-projects/spring-framework/commit/7387cb990e35b0f1b573faf29d4f9ae183d7a5eghsaWEB
- github.com/spring-projects/spring-framework/issues/15704ghsaWEB
- jira.spring.io/browse/SPR-11078ghsaWEB
News mentions
0No linked articles in our index yet.