org.springframework.ws/spring-ws vulnerabilities

Latest org.springframework.ws/spring-ws CVEs

Newest publication first

1. CVE-2019-3773 Spring Web Services XML External Entity Injection (XXE)

   Published 2019-01-18

   Critical·CVSS 9.8 EPSS 4.1%

   Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.