Spring Web Services XML External Entity Injection (XXE)
CVE-2019-3773

9.8CRITICAL

Key Information:

Vendor: Spring
Status: Spring Web Services
Vendor: CVE Published:; 18 January 2019

What is CVE-2019-3773?

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

Affected Version(s)

Spring Web Services 3.0

Spring Web Services 2.4

References

https://www.oracle.com/security-alerts/cpujan2021.html

https://pivotal.io/security/cve-2019-3773

https://www.oracle.com/security-alerts/cpuApr2021.html

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Jan 18, 2019
Vulnerability Reserved
Jan 3, 2019