CVE-2019-3772

2019-01-1822:29:00

Google

osv.dev

9.6 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.7%

JSON

Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

CPENameOperatorVersion
spring-integrationeq5.1.0.M1
spring-integrationeq5.1.0.RC1
spring-integrationeq5.1.0.RC2
spring-integrationeq5.1.0.M2
spring-integrationeq5.1.1.RELEASE
spring-integrationeq5.0.3.RELEASE
spring-integrationeq5.1.0.RELEASE
spring-integrationeq5.0.4.RELEASE
spring-integrationeq5.0.9.RELEASE
spring-integrationeq5.0.2.RELEASE

Name	Operator	Version
spring-integration	eq	5.1.0.M1
spring-integration	eq	5.1.0.RC1
spring-integration	eq	5.1.0.RC2
spring-integration	eq	5.1.0.M2
spring-integration	eq	5.1.1.RELEASE
spring-integration	eq	5.0.3.RELEASE
spring-integration	eq	5.1.0.RELEASE
spring-integration	eq	5.0.4.RELEASE
spring-integration	eq	5.0.9.RELEASE
spring-integration	eq	5.0.2.RELEASE