CVE-2013-4152: Cross-Site Request Forgery in Spring Framework
Summary
CVE-2013-4152: Cross-Site Request Forgery in Spring Framework. Affects org.springframework:spring-oxm versions < 3.2.4.RELEASE. Fixed in 3.2.4.RELEASE. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2013-4152 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a popular open-source application framework for Java. It provides comprehensive infrastructure support for developing Java applications. The Spring OXM (Object/XML Mapping) wrapper is a part of the Spring Framework that allows developers to work with XML data using various XML technologies. One of the XML technologies supported by the Spring OXM wrapper is JAXB (Java Architecture for XML Binding). JAXB is a Java API for mapping XML to Java objects and vice versa. However, prior to versions 3.2.4 and 4.0.0.M1 of the Spring Framework, when using the JAXB marshaller, the Spring OXM wrapper does not disable entity resolution. This vulnerability allows context-dependent attackers to exploit XML external entity (XXE) issues, leading to arbitrary file reading, denial of service, and cross-site request forgery (CSRF) attacks.
Vulnerability Detail
The vulnerability arises from the failure to disable entity resolution in the Spring OXM wrapper when using the JAXB marshaller. This allows an attacker to inject malicious XML content that includes an XML external entity declaration and an entity reference. By exploiting this vulnerability, an attacker can read arbitrary files, cause a denial of service, and conduct CSRF attacks. The vulnerability is considered moderate in severity and has been assigned the Common Weakness Enumeration (CWE) ID CWE-352.
How To Fix
Latest published version: 7.1.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.4.RELEASE
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, developers can mitigate the risk by implementing proper input validation and sanitization techniques when processing XML data. This includes validating and restricting the XML content to prevent the injection of malicious XML external entities.
Conclusion
The CVE-2013-4152 vulnerability in the Spring Framework's Spring OXM wrapper exposes applications to XML external entity (XXE) attacks, allowing attackers to read arbitrary files, cause denial of service, and perform cross-site request forgery (CSRF) attacks. To mitigate the risk, developers should upgrade to a fixed version of the Spring Framework and implement proper input validation and sanitization techniques when processing XML data. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-oxm →
FAQ
The vulnerability allows an attacker to read arbitrary files, cause a denial of service, and conduct CSRF attacks.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
XML external entity (XXE) vulnerability is a type of attack where an attacker can exploit the processing of XML data to read arbitrary files, perform server-side request forgery (SSRF), or cause denial of service.
Yes, a patch is available for this vulnerability. Developers should upgrade to version 3.2.4.RELEASE or later of the Spring Framework to fix the vulnerability.
There are known exploits for this vulnerability. Attackers can craft malicious XML content to exploit the vulnerability and perform unauthorized actions.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-oxm.
