Description (CNA)
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Spring / Spring Web Services | affected 3.0 before v3.0.4.RELEASE; affected 2.4 before v2.4.3.RELEASE |
CWE
CWE-611
References
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://pivotal.io/security/cve-2019-3773
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://security.netapp.com/advisory/ntap-20231227-0011/
ADP enrichment
No English description supplied.