CVE-2019-3772

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
Spring	Spring Integration	>= 5.0, < v5.0.10.RELEASE; >= 5.1, < v5.1.1.RELEASE; >= 4.3, < v4.3.18.RELEASE

References

http://www.securityfocus.com/bid/106749Third Party Advisory, VDB Entry
https://pivotal.io/security/cve-2019-3772Mitigation, Vendor Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlPatch
http://www.securityfocus.com/bid/106749Third Party Advisory, VDB Entry
https://pivotal.io/security/cve-2019-3772Mitigation, Vendor Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlPatch

Timeline

Published: Jan 18, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-37739.8Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity In CVE-2019-37749.8Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when rece CVE-2019-37756.5Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a d CVE-2019-37765.4Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions p CVE-2019-37779.8Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that CVE-2019-37786.5Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsup CVE-2019-37798.8Cloud Foundry Container Runtime, versions prior to 0.29.0, deploys Kubernetes clusters utilize the same CA (Certificate Authority) to sign a CVE-2019-37808.8Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials CVE-2019-37818.8Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticate CVE-2019-37827.8Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to it CVE-2019-37838.8Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session st CVE-2019-37846.5Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multip