Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2019-3773

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

VectorNETWORK

PublishedJan 18, 2019, 22:29

Published Bysecurity_alert@emc.com

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.springframework.ws:spring-ws(Maven)02.4.4N/A

org.springframework.ws:spring-ws(Maven)3.0.03.0.6N/A

org.springframework.ws:spring-xml(Maven)02.4.4N/A

org.springframework.ws:spring-xml(Maven)3.0.03.0.6N/A

References

https://pivotal.io/security/cve-2019-3773
https://security.netapp.com/advisory/ntap-20231227-0011/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html

Weakness Type

CWE-611

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK