CVEvulnerability
CVE-2019-3773
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-01-18
- Last modified
- 2026-09-04
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-611
Description
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Affected configurations
• broadcom spring web services (<= 2.4.3)
• broadcom spring web services (>= 3.0.0 <= 3.0.4)
• oracle financial services analytical applications infrastructure (>= 8.0.6 <= 8.1.0)
• oracle flexcube private banking 12.0.0
• oracle flexcube private banking 12.1.0
Related
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- https://pivotal.io/security/cve-2019-3773 Vendor Advisory
- https://security.netapp.com/advisory/ntap-20231227-0011/ security.netapp.com
- https://www.oracle.com//security-alerts/cpujul2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html Not Applicable
- https://www.oracle.com/security-alerts/cpujan2021.html Patch, Third Party Advisory
- https://pivotal.io/security/cve-2019-3773 Vendor Advisory
- https://security.netapp.com/advisory/ntap-20231227-0011/ security.netapp.com
- https://www.oracle.com//security-alerts/cpujul2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html Not Applicable
- https://www.oracle.com/security-alerts/cpujan2021.html Patch, Third Party Advisory