What’s Vulnerable › Vulnerabilities

CVE-2019-3772: Spring Integration XML External Entity Injection (XXE)

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-01-18 · updated 2026-06-17
• Weakness: CWE-611

Description

Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

Affected products

• Oracle Corporation Retail Customer Management and Segmentation Foundation: 16.0, 17.0, 18.0
• Spring Integration: through 4.3.18; from 5.0.0 through 5.0.10; from 5.1.0 through 5.1.1
• Spring Integration: from 5.0 before v5.0.10.RELEASE; from 5.1 before v5.1.1.RELEASE; from 4.3 before v4.3.18.RELEASE — fixed in v5.0.10.RELEASE, v5.1.1.RELEASE, v4.3.18.RELEASE

How to fix

Upgrade to a fixed version: Spring Integration v5.0.10.RELEASE, v5.1.1.RELEASE, v4.3.18.RELEASE. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/106749
• https://pivotal.io/security/cve-2019-3772
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
• http://www.securityfocus.com/bid/106749
• https://pivotal.io/security/cve-2019-3772
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Get alerted when CVE-2019-3772 or the next vulnerability affects your stack