CVE-2019-3772 Spring Integration XML External Entity Injection (XXE)

🗓️ 18 Jan 2019 22:00:00Reported by dellType

CVE-2019-3772 Spring Integration XML External Entity Injectio

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of the software platform for integrating Spring Integration corporate applications lies in improper restrictions on XML references to external objects. This allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	30 Apr 201900:00	–	bdu_fstec
CVE	CVE-2019-3772	18 Jan 201922:00	–	cve
EUVD	EUVD-2019-0197	7 Oct 202500:30	–	euvd
Github Security Blog	Improper Restriction of XML External Entity Reference in org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml	25 Jan 201916:18	–	github
NVD	CVE-2019-3772	18 Jan 201922:29	–	nvd
Oracle	Oracle Critical Patch Update Advisory - April 2019	16 Apr 201900:00	–	oracle
OSV	CVE-2019-3772	18 Jan 201922:29	–	osv
OSV	GHSA-WR5R-M8PC-85J9 Improper Restriction of XML External Entity Reference in org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml	25 Jan 201916:18	–	osv
Prion	Xxe	18 Jan 201922:29	–	prion
RedhatCVE	CVE-2019-3772	5 Apr 202010:59	–	redhatcve

[
  {
    "product": "Spring Integration",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "v5.0.10.RELEASE",
        "status": "affected",
        "version": "5.0",
        "versionType": "custom"
      },
      {
        "lessThan": "v5.1.1.RELEASE",
        "status": "affected",
        "version": "5.1",
        "versionType": "custom"
      },
      {
        "lessThan": "v4.3.18.RELEASE",
        "status": "affected",
        "version": "4.3",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
pivotal	www.pivotal.io/security/cve-2019-3772
securityfocus	www.securityfocus.com/bid/106749
oracle	www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

23 Apr 2019 19:08Current

9.7High risk

Vulners AI Score9.7

EPSS0.01724

CWE-611