CVE-2019-3772

Source
https://nvd.nist.gov/vuln/detail/CVE-2019-3772
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3772.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-3772
Aliases
Withdrawn
2024-05-15T05:31:34.433445Z
Published
2019-01-18T22:29:00Z
Modified
2023-11-29T07:29:17.906924Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

References

Affected packages

Git / github.com/spring-projects/spring-integration

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-integration
Events

Affected versions

v5.*

v5.0.0.RELEASE
v5.0.1.RELEASE
v5.0.10.RELEASE
v5.0.2.RELEASE
v5.0.3.RELEASE
v5.0.4.RELEASE
v5.0.5.RELEASE
v5.0.6.RELEASE
v5.0.7.RELEASE
v5.0.8.RELEASE
v5.0.9.RELEASE
v5.1.0.M1
v5.1.0.M2
v5.1.0.RC1
v5.1.0.RC2
v5.1.0.RELEASE
v5.1.1.RELEASE