org.springframework.ws:spring-xml@3.0.10.RELEASE

org.springframework.ws:spring-xml is a dependency of org.springframework.ws.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection via the Jaxp13XPathTemplate class in Jaxp13XPathTemplate.java. When XPath expressions are evaluated against StreamSource and SAXSource inputs, the template parses the XML through XPath.evaluate(String, InputSource, QName), which uses the JDK's default DocumentBuilderFactory and bypasses spring-xml's hardened parser configuration. As a result, external entity references in attacker-controlled XML are resolved during parsing. An attacker who can supply or influence the XML evaluated by an application can exploit XML External Entity (XXE) processing to read confidential local files or trigger server-side request forgery (SSRF) through external entities, depending on parser and platform behavior.

Note:

This is only exploitable if the application evaluates XPath over data controlled or influenced by remote users using the affected StreamSource or SAXSource types without an additional hardening layer.

Upgrade org.springframework.ws:spring-xml to version 4.1.4, 5.0.2 or higher.