CVSS 3.0
9.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2019-3772
Critical (9.8). EPSS 3.0% chance of exploitation in the next 30 days. Fixed in org.springframework.integration:spring-integration-xml 4.3.19, 5.0.11, 5.1.2.
Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Severity
- EPSS
- 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
- CWE
- CWE-611
- Published
- Modified
- Record from
- the NVD, synced
Affected
- oracle:retail_customer_management_and_segmentation_foundation
- vmware:spring_integration
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wr5r-m8pc-85j9 | Maven | org.springframework.integration:spring-integration-xml | <4.3.19 | 4.3.19 |
| GHSA-wr5r-m8pc-85j9 | Maven | org.springframework.integration:spring-integration-xml | >=5.0.0 <5.0.11 | 5.0.11 |
| GHSA-wr5r-m8pc-85j9 | Maven | org.springframework.integration:spring-integration-xml | >=5.1.0 <5.1.2 | 5.1.2 |
| GHSA-wr5r-m8pc-85j9 | Maven | org.springframework.integration:spring-integration-ws | <4.3.19 | 4.3.19 |
| GHSA-wr5r-m8pc-85j9 | Maven | org.springframework.integration:spring-integration-ws | >=5.0.0 <5.0.11 | 5.0.11 |
| GHSA-wr5r-m8pc-85j9 | Maven | org.springframework.integration:spring-integration-ws | >=5.1.0 <5.1.2 | 5.1.2 |