Spring Web Services XML External Entity Injection (XXE)
CVE-2019-3773

9.8CRITICAL

Key Information:

Vendor: Spring
Status: Spring Web Services
Vendor: CVE Published:; 18 January 2019

What is CVE-2019-3773?

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Spring Web Services 3.0

Spring Web Services 2.4

References

https://www.oracle.com/security-alerts/cpujan2021.html

https://pivotal.io/security/cve-2019-3773

https://www.oracle.com/security-alerts/cpuApr2021.html

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Jan 18, 2019
Vulnerability Reserved
Jan 3, 2019

JSON

Spring

What is CVE-2019-3773?

Human OS v1.0: Ageing Is an Unpatched Zero-Day Vulnerability.

Affected Version(s)

References

CVSS V3.1

Timeline

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.