GHSA-wr5r-m8pc-85j9Low

Improper Restriction of XML External Entity Reference in org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml

Published
January 25, 2019
Last Modified
March 4, 2024

🔗 CVE IDs covered (1)

CVE-2019-3772 →

📋 Description

Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

🎯 Affected products6

  • maven/org.springframework.integration:spring-integration-xml:< 4.3.19
  • maven/org.springframework.integration:spring-integration-xml:>= 5.0.0, < 5.0.11
  • maven/org.springframework.integration:spring-integration-xml:>= 5.1.0, < 5.1.2
  • maven/org.springframework.integration:spring-integration-ws:< 4.3.19
  • maven/org.springframework.integration:spring-integration-ws:>= 5.0.0, < 5.0.11
  • maven/org.springframework.integration:spring-integration-ws:>= 5.1.0, < 5.1.2

🔗 References (6)