CVE-2019-3772

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

org.springframework.integration:spring-integration-samples (1.0.1.release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (1.0.1.release)

org.springframework.integration:spring-integration-ws MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: -...

nz.co.senanque:madura-workflow (>=0.0.3, <=1.0.1), nz.co.senanque:madura-workflow-ui (1.0.1) +4 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (3.0.0.release)

org.springframework.integration:spring-integration-xml MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: - nz.co.senanque:madura-workflow =0.0.3, =1.0...

org.springframework.integration:spring-integration-samples (1.0.2.release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (1.0.2.release)

org.springframework.integration:spring-integration-ws MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: -...

org.springframework.integration:spring-integration-samples (1.0.1.release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (1.0.1.release)

org.springframework.integration:spring-integration-xml MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: -...

org.springframework.integration:spring-integration-samples (1.0.2.release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (1.0.2.release)

org.springframework.integration:spring-integration-xml MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: -...

com.ahome-it:ahome-tooling-server-core (>=1.0.83-rc1, <=1.1.36-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.88-rc1, <=1.1.27-release) +396 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=4.1.5.release, <=4.3.17.release)

org.springframework.integration:spring-integration-xml MAVEN version =4.1.5.release, =1.0.83-rc1, =1.0.88-rc1, =1.0.83-rc1, =1.1.0-release, =1.0.83-rc1, =1.0.83-rc1, =1.0.0-rc1, =1.0.5-release, =1.2.23-release, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =2.0.0, =2.2.0, =2.4.0 and more Source cves:...

com.themodernway:themodernway-server-integration (>=2.0.0-rc1, <=2.1.6-release), org.springframework.cloud.stream.app:aggregate-counter-app-starters-build (>=2.0.0.release, <=2.0.2.release) +294 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=5.0.1.release, <=5.0.9.release)

org.springframework.integration:spring-integration-xml MAVEN version =5.0.1.release, =2.0.0-rc1, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2...

com.ahome-it:ahome-tooling-server-core (>=1.0.83-rc1, <=1.1.36-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.88-rc1, <=1.1.27-release) +396 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=4.1.5.release, <=4.3.17.release)

org.springframework.integration:spring-integration-xml MAVEN version =4.1.5.release, =1.0.83-rc1, =1.0.88-rc1, =1.0.83-rc1, =1.1.0-release, =1.0.83-rc1, =1.0.83-rc1, =1.0.0-rc1, =1.0.5-release, =1.2.23-release, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =2.0.0, =2.2.0, =2.4.0 and more Source cves:...

nz.co.senanque:madura-workflow (>=0.0.3, <=1.0.1), nz.co.senanque:madura-workflow-ui (1.0.1) +4 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (3.0.0.release)

org.springframework.integration:spring-integration-ws MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: - nz.co.senanque:madura-workflow =0.0.3, =1.0.1...

com.themodernway:themodernway-server-integration (>=2.0.0-rc1, <=2.1.6-release), org.springframework.cloud.stream.app:aggregate-counter-app-starters-build (>=2.0.0.release, <=2.0.2.release) +294 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=5.0.1.release, <=5.0.9.release)

org.springframework.integration:spring-integration-xml MAVEN version =5.0.1.release, =2.0.0-rc1, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2...

org.springframework.integration:spring-integration-samples (1.0.2.sr1) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (1.0.2.sr1)

org.springframework.integration:spring-integration-xml MAVEN version 1.0.2.sr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: -...

com.ahome-it:ahome-tooling-server-core (>=1.0.110-release, <=1.1.36-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.111-release, <=1.1.27-release) +20 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (>=4.2.0.release, <=4.3.17.release)

org.springframework.integration:spring-integration-ws MAVEN version =4.2.0.release, =1.0.110-release, =1.0.111-release, =1.0.111-release, =1.1.0-release, =1.0.111-release, =1.0.111-release, =1.0.0, =1.0.0-rc1, =1.0.5-release, =1.2.23-release, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =2.0.0, =2.4.0 and...

com.ahome-it:ahome-tooling-server-core (>=1.0.110-release, <=1.1.36-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.111-release, <=1.1.27-release) +20 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (>=4.2.0.release, <=4.3.17.release)

org.springframework.integration:spring-integration-ws MAVEN version =4.2.0.release, =1.0.110-release, =1.0.111-release, =1.0.111-release, =1.1.0-release, =1.0.111-release, =1.0.111-release, =1.0.0, =1.0.0-rc1, =1.0.5-release, =1.2.23-release, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =2.0.0, =2.4.0 and...

com.github.ptomli.bedrock:bedrock-core (1.0.0) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (2.2.1.release)

org.springframework.integration:spring-integration-ws MAVEN version 2.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: - com.github.ptomli.bedrock:bedrock-core 1.0.0...

CVE-2019-3772

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3772 Spring Integration XML External Entity Injection (XXE)

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3772

The CVE-2019-3772 entry concerns Spring Integration’s XML handling in the spring-integration-xml and spring-integration-ws modules. Affected versions are 4.3.18, 5.0.10, 5.1.1, and older unsupported releases. The root cause is an XML External Entity (XXE) vulnerability when processing XML data fr...