GitHub Advisoryadvisory · Maven

GHSA-3wc8-659g-r88q Low severity vulnerability that affects org.springframework.batch:spring-batch-core

LOW Published 2019-01-25 Modified 2025-09-23 Official page ↗
Aliases
CVE-2019-3774
Ecosystem
Maven
Packages
org.springframework.batch:spring-batch-core
Severity
Low
Weaknesses
CWE-611
Reviewed
2020-06-16

Affected packages

• Maven org.springframework.batch:spring-batch-core: < 3.0.10.RELEASE → fixed in 3.0.10.RELEASE • Maven org.springframework.batch:spring-batch-core: >= 4.0.0.RELEASE, < 4.0.2.RELEASE → fixed in 4.0.2.RELEASE • Maven org.springframework.batch:spring-batch-core: >= 4.1.0.RELEASE, < 4.1.1.RELEASE → fixed in 4.1.1.RELEASE

Description

Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

Related

Alias · CVE (1)

  • CVE-2019-3774 Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References