CVE-2019-3773

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2019
Source publication: Jan 18, 2019
Source updated: Sep 17, 2024
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Spring Web Services XML External Entity Injection (XXE)

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Spring Web Services

Vendor: Spring
Product: Spring Web Services
Platforms: Unknown
Default status: Unknown

Spring Web Services · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0	`affected`	custom	v3.0.4.RELEASE	Unavailable	None listed
2.4	`affected`	custom	v2.4.3.RELEASE	Unavailable	None listed