GHSA-8222-6fc8-mhvf
Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml
At a glance
- Published
- Updated
- CVE
- CVE-2019-3773
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.springframework.ws:spring-ws | introduced 0, fixed 2.4.4 |
| Maven · org.springframework.ws:spring-ws | introduced 3.0.0, fixed 3.0.6 |
| Maven · org.springframework.ws:spring-xml | introduced 0, fixed 2.4.4 |
| Maven · org.springframework.ws:spring-xml | introduced 3.0.0, fixed 3.0.6 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-3773 ADVISORY
- https://github.com/advisories/GHSA-8222-6fc8-mhvf ADVISORY
- https://pivotal.io/security/cve-2019-3773 WEB
- https://www.oracle.com/security-alerts/cpuApr2021.html WEB
- https://www.oracle.com/security-alerts/cpujan2021.html WEB
- https://www.oracle.com/security-alerts/cpujul2021.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |