GitHub Advisoryadvisory · Maven

GHSA-8222-6fc8-mhvf Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml

CRITICAL Published 2019-01-25 Modified 2021-06-15 Official page ↗
Aliases
CVE-2019-3773
Ecosystem
Maven
Packages
org.springframework.ws:spring-ws, org.springframework.ws:spring-xml
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2020-06-16

Affected packages

• Maven org.springframework.ws:spring-ws: < 2.4.4 → fixed in 2.4.4 • Maven org.springframework.ws:spring-ws: >= 3.0.0, < 3.0.6 → fixed in 3.0.6 • Maven org.springframework.ws:spring-xml: < 2.4.4 → fixed in 2.4.4 • Maven org.springframework.ws:spring-xml: >= 3.0.0, < 3.0.6 → fixed in 3.0.6

Description

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

Related

Alias · CVE (1)

  • CVE-2019-3773 Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References