Spring Web Services XML External Entity Injection (XXE) (Spring Spring Web Services)
En bref
- Source
- NVD
- EPSS
- EPSS 4.14 % · centile 91 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- dell
- Statut NVD
- Modified
Description
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Faiblesses (CWE)
- CWE-611 — Entité externe XML (XXE)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-8222-6fc8-mhvf — Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml
Références européennes
- ENISA EUVD · EUVD-2019-0179
- GCVE · GCVE-0-2019-3773
Avis du CERT-FR
- CERTFR-2023-AVI-1060 — Vulnérabilité dans NetApp Active IQ Unified Manager · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*≤ 2.4.3cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*≥ 3.0.0 ≤ 3.0.4cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*≥ 8.0.6 ≤ 8.1.0cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Spring · Spring Web Services | affected 3.0 < v3.0.4.RELEASE ; affected 2.4 < v2.4.3.RELEASE |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |