CVE-2019-3774
Spring Batch XML External Entity Injection (XXE)
N/A
Published: January 18, 2019 at 10:00 PM UTC
Updated: September 1, 2026 at 06:07 PM UTC
2 products affected across 2 vendorsSpring BatchSpring Batch
Using Spring Batch by Spring?
Get instant alerts when new vulnerabilities affect Spring Batch - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 3%
Description
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Affected range stops below 3.0.9.RELEASE, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.0.1.RELEASE, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.1.0.RELEASE, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (20)
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r01292194daa9ed3117b34dabec0c26929f6db13b9613fc144f720d52%40%3Cissues.servicemix.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r0153a08177fcfac7584c7b9ea3027f1e8f18f770126f905b9989190e%40%3Cissues.servicemix.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r08e7ddc354bdcbf95d88399f18b3d804865034f8bc706095e594b29f%40%3Cissues.servicemix.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r2349237482bcec43632d9d78d7d2804520d9a82f4d8b1fd96bb616b8%40%3Cissues.servicemix.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r47c7f67a3067ec09262eef0705abc42ea1b646699d9198bcaf8dad02%40%3Cissues.servicemix.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r78645ca0eef44a276e144447fb2087db758b1fb8826d0330b3f0da1a%40%3Cissues.servicemix.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r79991aeb5d0c53c67e400e037c72758a06607752ca2f23b5302dd61f%40%3Cissues.servicemix.apache.org%3EQuick Info
StatusMODIFIED
CWE
CWE-611
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card