EXPOSURES › CVE-2019-3773

CVE-2019-3773

CRITICAL

DETAIL

SourceNVD · cve Published2019-01-18 CVSS9.8 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2019-3773 ↗

▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.

PLAYERS IMPLICATED

Broadcom · vendor Oracle · vendor financial services analytical applications infrastructure · product flexcube private banking · product spring web services · product

DESCRIPTION

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

SENTIMENT · TRUSTED SOURCES

synthesis severe-fallout -0.60

Broadcom faced severe fallout from CVE-2019-3773, a critical XXE vulnerability in Spring Web Services that exposed untrusted XML data processing flaws, leading to widespread condemnation and urgent pa

cooey ↗ severe-fallout -0.80

NVD highlights the critical nature of the XXE flaw in Spring Web Services, emphasizing the severe risk of untrusted data exploitation.

"Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources."

support.broadcom.com ↗ severe-fallout -0.70

Broadcom support portal highlights critical vulnerabilities in VMware products, reflecting ongoing security concerns but not directly addressing CVE-2019-3773.

"VMSA-2026-0007: VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities (CVE-2026-59346, CVE-2026-59347)"

dailysecurityreview.com ↗ severe-fallout -0.50

Daily Security Review reports a separate Broadcom supply chain breach, reflecting broader trust issues but not directly tied to CVE-2019-3773.

"Broadcom employee data leaked after a ransomware attack on ADP partner Business Systems House. Sensitive files appeared on the dark web, impacting global semiconductor workers."

recentbreaches.com ↗ severe-fallout +0.00

Recent Breaches provides neutral breach tracking without vendor-specific sentiment.

www.cvefind.com ↗ severe-fallout +0.00

CVE Find offers neutral vulnerability intelligence without vendor sentiment.

xposedornot.com ↗ severe-fallout +0.00

XposedOrNot provides neutral breach directory data without vendor sentiment.

vulnpedia.com ↗ severe-fallout +0.00

Vulnpedia provides neutral, factual indexing of CVEs without specific vendor sentiment.

AFFECTED FEDRAMP PRODUCTS · 14

PRODUCT	PROVIDER	STATUS	MATCH
Aconex for Defense Oracle	Oracle	Authorized	vendor-exact · 0.90
Clarity Broadcom	Broadcom	Authorized	vendor-exact · 0.90
Federal Managed Cloud Services Oracle	Oracle	Authorized	vendor-exact · 0.90
Fusion Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
General Support Systems (GSS) Broadcom	Broadcom	Authorized	vendor-exact · 0.90
Government Cloud - Common Controls Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Cloud Infrastructure-Government Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Enterprise Performance Management (EPM) Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Enterprise Performance Management (EPM) - Moderate Oracle	Oracle	In Process	vendor-exact · 0.90
Oracle Service Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Service Cloud (DOD) Oracle	Oracle	Authorized	vendor-exact · 0.90
Rally Broadcom	Broadcom	Authorized	vendor-exact · 0.90
Symantec Gov Cloud Security (GCS) Broadcom	Broadcom	In Process	vendor-exact · 0.90
Taleo Cloud - U.S. Government Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90