CVE-2013-4152: The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable e

Spring Framework versions before 3.2.4 and 4.0.0.M1 have a vulnerability in their XML processing tool (Spring OXM wrapper with JAXB marshaller) that fails to disable entity resolution, which is a security feature that prevents processing of external XML entities. This allows attackers to read arbitrary files (files they shouldn't access), cause denial of service (making the application unavailable), and conduct CSRF attacks (cross-site request forgery, tricking users into performing unwanted actions) by embedding malicious XML external entity declarations in input data.