Read the docs
TI-2019-02786 Aliases CVE-2019-3772GHSA-wr5r-m8pc-85j9

Spring Integration XML External Entity Injection (XXE)

Priority MEDIUM 48CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

Why it matters now

EPSS 0.03002 87th percentileScored 2026-11-07
Fix Fixed Spring Integration (Spring): v5.0.10.RELEASE, v5.1.1.RELEASE, v4.3.18.RELEASEorg.springframework.integration:spring-integration-xml (Maven): 4.3.19, 5.0.11, 5.1.2+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareSpring Integration5.0 to before v5.0.10.RELEASE; 5.1 to before v5.1.1.RELEASE; 4.3 to before v4.3.18.RELEASEv5.0.10.RELEASE, v5.1.1.RELEASE, v4.3.18.RELEASEPatch availableCNA
—org.springframework.integration:spring-integration-xml (Maven)before 4.3.194.3.19Patch availableGHSA-wr5r-m8pc-85j9
—org.springframework.integration:spring-integration-xml (Maven)5.0.0 to before 5.0.115.0.11Patch availableGHSA-wr5r-m8pc-85j9
—org.springframework.integration:spring-integration-xml (Maven)5.1.0 to before 5.1.25.1.2Patch availableGHSA-wr5r-m8pc-85j9
—org.springframework.integration:spring-integration-ws (Maven)before 4.3.194.3.19Patch availableGHSA-wr5r-m8pc-85j9
—org.springframework.integration:spring-integration-ws (Maven)5.0.0 to before 5.0.115.0.11Patch availableGHSA-wr5r-m8pc-85j9
—org.springframework.integration:spring-integration-ws (Maven)5.1.0 to before 5.1.25.1.2Patch availableGHSA-wr5r-m8pc-85j9
  • Spring Integration VendorVMware Affected 5.0 to before v5.0.10.RELEASE; 5.1 to before v5.1.1.RELEASE; 4.3 to before v4.3.18.RELEASE Fixed in v5.0.10.RELEASE, v5.1.1.RELEASE, v4.3.18.RELEASE Patch available CNA
  • org.springframework.integration:spring-integration-xml (Maven) Vendor— Affected before 4.3.19 Fixed in 4.3.19 Patch available GHSA-wr5r-m8pc-85j9
  • org.springframework.integration:spring-integration-xml (Maven) Vendor— Affected 5.0.0 to before 5.0.11 Fixed in 5.0.11 Patch available GHSA-wr5r-m8pc-85j9
  • org.springframework.integration:spring-integration-xml (Maven) Vendor— Affected 5.1.0 to before 5.1.2 Fixed in 5.1.2 Patch available GHSA-wr5r-m8pc-85j9
  • org.springframework.integration:spring-integration-ws (Maven) Vendor— Affected before 4.3.19 Fixed in 4.3.19 Patch available GHSA-wr5r-m8pc-85j9
  • org.springframework.integration:spring-integration-ws (Maven) Vendor— Affected 5.0.0 to before 5.0.11 Fixed in 5.0.11 Patch available GHSA-wr5r-m8pc-85j9
  • org.springframework.integration:spring-integration-ws (Maven) Vendor— Affected 5.1.0 to before 5.1.2 Fixed in 5.1.2 Patch available GHSA-wr5r-m8pc-85j9

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*up to 4.3.18; 5.0.0 – 5.0.10; 5.1.0 – 5.1.1VulnerableVMware
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:*17.0VulnerableOracle
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*18.0VulnerableOracle
  • cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:* Versions up to 4.3.18; 5.0.0 – 5.0.10; 5.1.0 – 5.1.1 Vulnerable ·VMware
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:* Versions 18.0 Vulnerable ·Oracle

Remediation

  • Fix · CNA Spring Integration (Spring) Fixed in v5.0.10.RELEASE, v5.1.1.RELEASE, v4.3.18.RELEASE
  • Fix · GHSA-wr5r-m8pc-85j9 org.springframework.integration:spring-integration-xml (Maven) Fixed in 4.3.19 Advisory →
  • Fix · GHSA-wr5r-m8pc-85j9 org.springframework.integration:spring-integration-xml (Maven) Fixed in 5.0.11 Advisory →
  • Fix · GHSA-wr5r-m8pc-85j9 org.springframework.integration:spring-integration-xml (Maven) Fixed in 5.1.2 Advisory →
  • Fix · GHSA-wr5r-m8pc-85j9 org.springframework.integration:spring-integration-ws (Maven) Fixed in 4.3.19 Advisory →
  • Fix · GHSA-wr5r-m8pc-85j9 org.springframework.integration:spring-integration-ws (Maven) Fixed in 5.0.11 Advisory →
  • Fix · GHSA-wr5r-m8pc-85j9 org.springframework.integration:spring-integration-ws (Maven) Fixed in 5.1.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Fuse 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3772
  2. 2026-10-03 Alias added: GHSA-wr5r-m8pc-85j9

References

Patch 1

Advisory 3

Other 1

  • TI-2026-35313 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution CVSS 3.1CRITICAL 9.8
  • TI-2020-04459 Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets" CVSS 3.1CRITICAL 9.8
  • TI-2026-42455 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction CVSS 3.1HIGH 8.2
  • TI-2026-42439 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference CVSS 3.1HIGH 8.0
  • TI-2026-42425 SMB minimum protocol dialect defaults to SMB1 CVSS 3.1MEDIUM 6.6
  • TI-2026-29638 Path traversal in VMware Spring Integration CVSS 3.1HIGH 7.1
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences