XXE attack in Pivotal Spring Integration

Published: 2019-01-24
Severity Low
Patch available YES
Number of vulnerabilities 1
CVE ID CVE-2019-3772
Exploitation vector Network
Public exploit N/A
Vulnerable software
Spring Integration
Client/Desktop applications / Office applications

Vendor Pivotal

Security Advisory

This security advisory describes one low risk vulnerability.

1) XML External Entity injection

Severity: Low

CVSSv3: 7.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-3772

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')


The vulnerability allows a remote unauthenticated attacker to conduct XXE-attack.

The vulnerability exists due to improper handling of XML External Entities (XXEs) when parsing an XML file. A remote attacker can supply a specially crafted input and obtain potentially sensitive information or cause the service to crash


The vulnerability has been addressed in the versions 4.3.19, 5.0.11, 5.1.2.

Vulnerable software versions

Spring Integration: 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.3.12, 4.3.13, 4.3.14, 4.3.15, 4.3.16, 4.3.17, 4.3.18, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.1.0, 5.1.1

CPE External links


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.