critical9.8
CVE-2019-3773
Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml
Impact
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.ws:spring-ws | < 2.4.4 | 2.4.4 |
| maven | org.springframework.ws:spring-xml | < 2.4.4 | 2.4.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Broadcom | Spring Web Services | through 2.4.3 from 3.0.0 through 3.0.4 |
| Oracle | Financial Services Analytical Applications Infrastructure | from 8.0.6 through 8.1.0 |
| Oracle | Flexcube Private Banking | Versions 12.0.0, 12.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://pivotal.io/security/cve-2019-3773
- https://security.netapp.com/advisory/ntap-20231227-0011/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://github.com/advisories/GHSA-8222-6fc8-mhvf
- https://nvd.nist.gov/vuln/detail/CVE-2019-3773
- https://www.oracle.com/security-alerts/cpujul2021.html