Non notée
CVE-2019-3772 Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older…
Description
Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring Integration 5.1 | 5.1 → < 5.1.1.RELEASE | 5.1.1.RELEASE |
| Spring Integration 5.0 | 5.0 → < 5.0.10.RELEASE | 5.0.10.RELEASE |
| Spring Integration 4.3 | 4.3 → < 4.3.18.RELEASE | 4.3.18.RELEASE |
Autres CVE de Spring Integration
Les 16 CVE de Spring Integration →
CVE-2026-59324
When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads,…
8.2
Élevée
CVE-2026-59322
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor
6.3
Moyenne
CVE-2026-59321
A single ScriptEngine instance is reused for every message on a script-backed channel
4.2
Moyenne
CVE-2026-59311
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their…
6.8
Moyenne