GHSA-8222-6fc8-mhvf
Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2019-3773
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.springframework.ws:spring-ws | introduced 0, fixed 2.4.4 |
| Maven · org.springframework.ws:spring-ws | introduced 3.0.0, fixed 3.0.6 |
| Maven · org.springframework.ws:spring-xml | introduced 0, fixed 2.4.4 |
| Maven · org.springframework.ws:spring-xml | introduced 3.0.0, fixed 3.0.6 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2019-3773 ADVISORY
- https://github.com/advisories/GHSA-8222-6fc8-mhvf ADVISORY
- https://pivotal.io/security/cve-2019-3773 WEB
- https://www.oracle.com/security-alerts/cpuApr2021.html WEB
- https://www.oracle.com/security-alerts/cpujan2021.html WEB
- https://www.oracle.com/security-alerts/cpujul2021.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |