Critical severity · published Jan 18, 2019
CVE-2019-3773
Spring Web Services XML External Entity Injection (XXE)
9.8
CVSS
4.1%
EPSS
No
On KEV
Description
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.1% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SW
Spring Web Services · Spring
3.0 before v3.0.4.RELEASE; 2.4 before v2.4.3.RELEASE · source: vendor, NVD
FS
Financial Services Analytical Applications Infrastructure · Oracle
8.0.6 through 8.1.0 · source: NVD
FP
Flexcube Private Banking · Oracle
12.0.0; 12.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3773
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3773
Vendor Advisory
https://pivotal.io/security/cve-2019-3773
security.netapp.com
https://security.netapp.com/advisory/ntap-20231227-0011/
Patch
https://www.oracle.com//security-alerts/cpujul2021.html
Not Applicable
https://www.oracle.com/security-alerts/cpuApr2021.html
Patch
https://www.oracle.com/security-alerts/cpujan2021.html
More from Spring Web Services
8.6
CVE-2026-40999
Spring WS SSRF via unvalidated WS-Addressing reply destinations
8.2
CVE-2026-40998
Jaxp13 XPath XXE via StreamSource and SAXSource
8.2
CVE-2026-40994
Wss4jSecurityInterceptor disables WS-I BSP validation by default
5.4
CVE-2026-40995
X.509 authentication bypasses Spring Security account checks
5.3
CVE-2026-40997
SOAP security faults leak Spring Security account state