Check Point Advisories

SpringSource Spring Framework XML External Entity Information Disclosure (CVE-2013-4152)

Check Point Reference: CPAI-2013-2962
Date Published: 27 Oct 2013
Severity: High
Last Updated: Friday 19 April, 2024
Source: CVE-2013-4152
Protection Provided by:

Security Gateway
R75
Who is Vulnerable? SpringSource Spring Framework 3.0.0 to 3.2.3
SpringSource Spring Framework 4.0.0.M1-4.0.0.M2
Vulnerability Description An information disclosure vulnerability exists in SpringSource Spring Framework.
Vulnerability DetailsThe vulnerability is due to incorrectly configured XML parsing which accepts XML external entities from untrusted sources. A remote, unauthenticated attacker can leverage this vulnerability by sending a malicious request to the target server. Successful exploitation would result in the disclosure of information from arbitrary files available to the security context of the server application.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your product to the latest update. For information on how to update , go to SBP-2006-05, Protection tab and select the version of your choice.

Security Gateway R75 / R71 / R70

  1. In the IPS tab, click Protections and find the SpringSource Spring Framework XML External Entity Information Disclosure protection using the Search tool and Edit the protection's settings.
  2. Install policy on all modules.

SmartView Tracker will log the following entries:
Attack Name: Application Servers Protection Violation
Attack Information: SpringSource Spring Framework XML External Entity Information Disclosure

×
  Feedback
This website uses cookies for its functionality and for analytics and marketing purposes. By continuing to use this website, you agree to the use of cookies. For more information, please read our Cookies Notice.
OK