GHSA-8222-6fc8-mhvfCriticalCVSS 9.8

Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml

Published
January 25, 2019
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2019-3773 →

📋 Description

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

🎯 Affected products4

  • maven/org.springframework.ws:spring-ws:< 2.4.4
  • maven/org.springframework.ws:spring-ws:>= 3.0.0, <= 3.0.4
  • maven/org.springframework.ws:spring-xml:< 2.4.4
  • maven/org.springframework.ws:spring-xml:>= 3.0.0, <= 3.0.4

🔗 References (6)