CVE-2019-3773 Spring Web Services XML External Entity Injection (XXE)

2019-01-1822:00:00

CWE-611

dell

www.cve.org

AI Score

9.7

Confidence

High

EPSS

0.006

Percentile

78.7%

JSON

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

CNA Affected

[
  {
    "vendor": "Spring",
    "product": "Spring Web Services",
    "versions": [
      {
        "version": "3.0",
        "status": "affected",
        "lessThan": "v3.0.4.RELEASE",
        "versionType": "custom"
      },
      {
        "version": "2.4",
        "status": "affected",
        "lessThan": "v2.4.3.RELEASE",
        "versionType": "custom"
      }
    ]
  }
]