GitHub Advisoryadvisory · Maven

GHSA-wr5r-m8pc-85j9 Improper Restriction of XML External Entity Reference in org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml

LOW Published 2019-01-25 Modified 2024-03-04 Official page ↗
Aliases
CVE-2019-3772
Ecosystem
Maven
Packages
org.springframework.integration:spring-integration-xml, org.springframework.integration:spring-integration-ws
Severity
Low
Weaknesses
CWE-611
Reviewed
2020-06-16

Affected packages

• Maven org.springframework.integration:spring-integration-xml: < 4.3.19 → fixed in 4.3.19 • Maven org.springframework.integration:spring-integration-xml: >= 5.0.0, < 5.0.11 → fixed in 5.0.11 • Maven org.springframework.integration:spring-integration-xml: >= 5.1.0, < 5.1.2 → fixed in 5.1.2 • Maven org.springframework.integration:spring-integration-ws: < 4.3.19 → fixed in 4.3.19 • Maven org.springframework.integration:spring-integration-ws: >= 5.0.0, < 5.0.11 → fixed in 5.0.11 • Maven org.springframework.integration:spring-integration-ws: >= 5.1.0, < 5.1.2 → fixed in 5.1.2

Description

Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

Related

Alias · CVE (1)

  • CVE-2019-3772 Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References