XXE in Broadcom Spring Batch
CVE-2019-3774
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Vulnerability class: XXE (XML External Entity)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.030 (87.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 87.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.030 · newest: 0.030 · change: 0.000
Affected products
- Broadcom Spring Batch — versions 4.1.0
- Pivotal Software Spring Batch — versions 4.1.0
- Spring Batch — versions 4.0, 4.1, 3.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- pivotal.io/security/cve-2019-3774 (Mitigation, Vendor Advisory)
- lists.apache.org/thread.html/rcd26a5409af7356b5f69b2fafae3cf621bff8bf155f50e9cc… (mailing-list)
- lists.apache.org/thread.html/rfea6eebfebb13bc015f258e7fa31d4e24a4202601be3b307d… (mailing-list)
- lists.apache.org/thread.html/ree71c6425d2cc0e36b77bda6902965a657c1e09c722945981… (mailing-list)
- lists.apache.org/thread.html/r47c7f67a3067ec09262eef0705abc42ea1b646699d9198bca… (mailing-list)
- lists.apache.org/thread.html/r2349237482bcec43632d9d78d7d2804520d9a82f4d8b1fd96… (mailing-list)
- lists.apache.org/thread.html/rcd4945d66d8bb2fc92396af56a70ede4af983a2c98166f128… (mailing-list)
- lists.apache.org/thread.html/ra62a3bf48ab4e0e9aaed970b03d79a73224d68a4275858c70… (mailing-list)
- lists.apache.org/thread.html/r01292194daa9ed3117b34dabec0c26929f6db13b9613fc144… (mailing-list)
- lists.apache.org/thread.html/ra8c7573911082e9968f4835943045ad0952232bb6314becf2… (mailing-list)
Frequently asked questions
- What is CVE-2019-3774?
- CVE-2019-3774 is a critical-severity vulnerability in Broadcom Spring Batch, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 9.8/10. Published 2019-01-18.
- How severe is CVE-2019-3774?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-3774 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.