CVE-2019-3772

Published: Jan 18, 2019Modified: Jun 17, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

Affected (6)

Products: Vmware: Spring Integration · Oracle: Retail Customer Management And Segmentation Foundation

Vmware

1 product

Spring Integration

Oracle

1 product

Retail Customer Management And Segmentation Foundation

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Vmware Spring Integration	Up to 4.3.18
Vmware Spring Integration	From 5.0.0 to 5.0.10
Vmware Spring Integration	From 5.1.0 to 5.1.1

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Oracle Retail Customer Management And Segmentation Foundation	Version 16.0
Oracle Retail Customer Management And Segmentation Foundation	Version 17.0
Oracle Retail Customer Management And Segmentation Foundation	Version 18.0