GHSA-3wc8-659g-r88qLow

Low severity vulnerability that affects org.springframework.batch:spring-batch-core

Published
January 25, 2019
Last Modified
September 23, 2025

🔗 CVE IDs covered (1)

CVE-2019-3774 →

📋 Description

Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

🎯 Affected products3

  • maven/org.springframework.batch:spring-batch-core:< 3.0.10.RELEASE
  • maven/org.springframework.batch:spring-batch-core:>= 4.0.0.RELEASE, < 4.0.2.RELEASE
  • maven/org.springframework.batch:spring-batch-core:= 4.1.0.RELEASE

🔗 References (21)