CVE-2013-4152: The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does...

Security readout for executives and security teams

This issue affects applications using vulnerable Spring Framework OXM JAXB marshalling to process XML. If attacker-controlled XML reaches that path, the application may resolve external entities, enabling file disclosure, denial of service, or server-side request forgery-like CSRF behavior depending on environment and permissions. Exposure is most likely in Java applications using affected Spring Framework versions, Spring OXM, JAXB marshalling, and XML input from users, partners, APIs, queues, or files. Applications not using Spring OXM JAXB paths are less likely exposed. Prioritize remediation for internet-facing or partner-facing services that accept XML and run affected Spring versions. The business risk is data exposure and service disruption, not merely a library hygiene issue. Mitigation focus: Upgrade Spring Framework to 3.2.4 or later supported fixed versions.; Apply relevant downstream vendor updates from Red Hat or Debian if using packaged Spring components.; Disable external entity resolution in XML processing where configurable..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.