Test ID:	1.3.6.1.4.1.25623.1.1.10.2014.0096
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2014-0096)
Summary:	The remote host is missing an update for the 'springframework' package(s) announced via the MGASA-2014-0096 advisory.
Description:	Summary: The remote host is missing an update for the 'springframework' package(s) announced via the MGASA-2014-0096 advisory. Vulnerability Insight: It was discovered by the Spring development team that the fix for the XML External Entity (XXE) Injection (CVE-2013-4152) in the Spring Framework was incomplete. Spring MVC's SourceHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them. SourceHttpMessageConverter has been modified to provide an option to control the processing of XML external entities and that processing is now disabled by default (CVE-2013-6429). In addition Jon Passki discovered a possible XSS vulnerability: The JavaScriptUtils.javaScriptEscape() method did not escape all characters that are sensitive within either a JS single quoted string, JS double quoted string, or HTML script data context. In most cases this will result in an unexploitable parse error but in some cases it could result in an XSS vulnerability (CVE-2013-6430). Affected Software/OS: 'springframework' package(s) on Mageia 3, Mageia 4. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-6429 20140114 CVE-2013-6429 Fix for XML External Entity (XXE) injection (CVE-2013-4152) in Spring Framework was incomplete http://www.securityfocus.com/archive/1/530770/100/0/threaded 57915 http://secunia.com/advisories/57915 64947 http://www.securityfocus.com/bid/64947 RHSA-2014:0400 http://rhn.redhat.com/errata/RHSA-2014-0400.html http://www.gopivotal.com/security/cve-2013-6429 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755 https://jira.springsource.org/browse/SPR-11078?page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel Common Vulnerability Exposure (CVE) ID: CVE-2013-6430 http://www.gopivotal.com/security/cve-2013-6430 https://github.com/spring-projects/spring-framework/commit/7a7df6637478607bef0277bf52a4e0a03e20a248 https://jira.springsource.org/browse/SPR-9983
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.