CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2019-3773
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Severity
- EPSS
- 4.1% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- CWE
- CWE-611
- Published
- Modified
- Record from
- the NVD, synced
Affected
- broadcom:spring_web_services
- oracle:financial_services_analytical_applications_infrastructure
- oracle:flexcube_private_banking
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8222-6fc8-mhvf | Maven | org.springframework.ws:spring-ws | <2.4.4 | 2.4.4 |
| GHSA-8222-6fc8-mhvf | Maven | org.springframework.ws:spring-ws | >=3.0.0 <3.0.6 | 3.0.6 |
| GHSA-8222-6fc8-mhvf | Maven | org.springframework.ws:spring-xml | <2.4.4 | 2.4.4 |
| GHSA-8222-6fc8-mhvf | Maven | org.springframework.ws:spring-xml | >=3.0.0 <3.0.6 | 3.0.6 |