CVE-2019-3773
Medium
Elevated severity or exploit probability.
CVSS base
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — probability of exploitation (30 days)
4.1%
90.3th percentile
CISA KEV
Not listed
Weakness / dates
CWE-611
Published 2019-01-18 · modified 2026-09-04
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | N | None |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | H | High |
| Integrity | H | High |
| Availability | H | High |
Timeline
- 2019-01-18 — Published (NVD)
- 2026-09-04 — Last modified (NVD)
Description
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Affected
References
- https://pivotal.io/security/cve-2019-3773
- https://security.netapp.com/advisory/ntap-20231227-0011/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://pivotal.io/security/cve-2019-3773
- https://security.netapp.com/advisory/ntap-20231227-0011/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html