CVE-2019-3772 Spring Integration XML External Entity Injection (XXE)

2019-01-1822:00:00

CWE-611

dell

www.cve.org

AI Score

9.7

Confidence

High

EPSS

0.005

Percentile

76.9%

JSON

Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

CNA Affected

[
  {
    "product": "Spring Integration",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "v5.0.10.RELEASE",
        "status": "affected",
        "version": "5.0",
        "versionType": "custom"
      },
      {
        "lessThan": "v5.1.1.RELEASE",
        "status": "affected",
        "version": "5.1",
        "versionType": "custom"
      },
      {
        "lessThan": "v4.3.18.RELEASE",
        "status": "affected",
        "version": "4.3",
        "versionType": "custom"
      }
    ]
  }
]