Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2019-3774GHSA-3WC8-659G-R88Q

Spring Batch XML External Entity Injection (XXE)

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 4.0.1.RELEASE, 4.1.0.RELEASE, 3.0.9.RELEASE, 3.0.10.RELEASE, 4.0.2.RELEASE, and 1 more
None on Exploit-DB, Metasploit or GitHub

Summary

Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Spring Spring Batch

    From 4.0 · fixed in 4.0.1.RELEASE; From 4.1 · fixed in 4.1.0.RELEASE; From 3.0 · fixed in 3.0.9.RELEASE

  • org.springframework.batch:spring-batch-coreMaven

    fixed in 3.0.10.RELEASE

  • org.springframework.batch:spring-batch-coreMaven

    From 4.0.0.RELEASE · fixed in 4.0.2.RELEASE

  • org.springframework.batch:spring-batch-coreMaven

    From 4.1.0.RELEASE · fixed in 4.1.1.RELEASE

References 20

pivotal.io

lists.apache.org