CVE-2019-3773
criticalSpring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when…
Vendor / product: Broadcom — spring web services
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2019-01-18 22:29
Modified: 2026-09-04 13:45
NVD status: Modified
Last synced 2 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
broadcom / spring_web_services ≤2.4.3, ≥3.0.0 ≤3.0.4
oracle / financial_services_analytical_applications_infrastructure ≥8.0.6 ≤8.1.0
oracle / flexcube_private_banking 12.0.0, 12.1.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://pivotal.io/security/cve-2019-3773
Vendor advisory: https://pivotal.io/security/cve-2019-3773
Patch / mitigation: https://www.oracle.com//security-alerts/cpujul2021.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpujan2021.html
Patch / mitigation: https://www.oracle.com//security-alerts/cpujul2021.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpujan2021.html
References
- https://pivotal.io/security/cve-2019-3773 security_alert@emc.com
- https://security.netapp.com/advisory/ntap-20231227-0011/ security_alert@emc.com
- https://www.oracle.com//security-alerts/cpujul2021.html security_alert@emc.com
- https://www.oracle.com/security-alerts/cpuApr2021.html security_alert@emc.com
- https://www.oracle.com/security-alerts/cpujan2021.html security_alert@emc.com
- https://pivotal.io/security/cve-2019-3773 af854a3a-2127-422b-91ae-364da2661108
- https://security.netapp.com/advisory/ntap-20231227-0011/ af854a3a-2127-422b-91ae-364da2661108
- https://www.oracle.com//security-alerts/cpujul2021.html af854a3a-2127-422b-91ae-364da2661108
- https://www.oracle.com/security-alerts/cpuApr2021.html af854a3a-2127-422b-91ae-364da2661108
- https://www.oracle.com/security-alerts/cpujan2021.html af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗