Jaxp13 XPath XXE via StreamSource and SAXSource (Spring Spring Web Services)
En bref
- Source
- NVD
- EPSS
- EPSS 0.35 % · centile 29 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- vmware
- Statut NVD
- Analyzed
Rechercher sur…
Description
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Faiblesses (CWE)
- CWE-611 — Entité externe XML (XXE)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | vmware |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | NVD · security@vmware.com (Secondary) |
Avis
- GHSA-2mpf-m756-hxjm — Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource
Références européennes
- ENISA EUVD · EUVD-2026-36208
- GCVE · GCVE-0-2026-40998
Avis du CERT-FR
- CERTFR-2026-AVI-0739 — Multiples vulnérabilités dans les produits Spring · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*< 3.1.9cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.19cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.3.1cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.0.1.1
Produits affectés
| Produit | Versions |
|---|---|
| Spring · Spring Web Services | affected 5.0.0 < 5.0.1.1 ; affected 4.1.0 < 4.1.3.1 ; affected 4.0.0 < 4.0.19 ; affected 3.1.0 < 3.1.9 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |