{"data":{"id":"1f0307b6-5439-4511-8b42-d45f2217d6d6","title":"CVE-2013-7315: The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity…","summary":"The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory. Context-dependent attackers can exploit this via crafted XML with JAXB to read arbitrary files, cause a denial of service, and conduct CSRF attacks. The issue is an XML External Entity (XXE) flaw and was split from CVE-2013-4152 due to different affected versions.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2013-7315","publishedAt":"2014-01-24T02:55:05.210Z","cveId":"CVE-2013-7315","cweIds":["CWE-264"],"cvssScore":"6.8","cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["org.springframework:spring-oxm@<= 3.2.3.RELEASE (fixed: 3.2.4.RELEASE)"],"affectedPackageNames":["org-springframework:spring-oxm"],"affectedPackageRefs":["maven:org-springframework:spring-oxm"],"affectedVendors":[],"affectedVendorsRaw":["Spring MVC","Spring Framework"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Spring MVC XML external entity resolution flaw via StAX XMLInputFactory","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.05065,"epssCheckedAt":"2026-11-04T18:09:14.876Z","kevDateAdded":null,"advisoryAliases":["GHSA-vp63-rrcm-9mph"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T04:01:18.135Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:53:06.657Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","availability"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.3,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":null,"name":"org.springframework:spring-oxm","fixedVersion":"3.2.4.RELEASE","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-10-29T21:53:06.505Z"}]}}