Short Name |
HTTP:SPRING-XMLENTITY-INFODISC1 |
---|---|
Severity |
Minor |
Recommended |
No |
Category |
HTTP |
Keywords |
SpringSource Spring Framework XML External Entity Parsing Information Disclosure1 |
Release Date |
2015/10/07 |
Update Number |
2543 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
This signature detects attempts to exploit a know vulnerability against SpringSource Spring Framework. The vulnerability is due to incorrectly configured XML parsing which accepts XML external entities from untrusted sources. A remote, unauthenticated attacker can leverage this vulnerability by sending a malicious request to the target server. Successful exploitation would result in the disclosure of information from arbitrary files available to the security context of the server application.