CVE-2019-5427

mediumpriority · track · 42EPSS 0.049 · 92 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

4.88% (92nd) EPSS

CVSS 5 · medium

Is it mine?

74 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-22

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.17.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Psecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-776USprimaryCWE-399USCWE-776USCWE-776US

exploits (1)

Public proof-of-concept and weaponised exploit code.

shanika04/cp30_XXE_partial_fixversion between CVE-2018-20433 and CVE-2019-5427PoC · poc_in_github

affected products (74)

Products and version ranges known to be affected.

IBM QRadar SIEM <7.5.0 UP13 IF01all versionscert_bundDE
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Dell Data Protection Advisor< 19.12 SP2cert_bundDE
IBM QRadar SIEM< 7.5.0 UP13 IF01cert_bundDE
n/a c3p0≤ before 0.9.5.4enisa_euvdEU
Fedora Project Fedora≤ 30fstec_bduRU
Fedora Project Fedora≤ 29fstec_bduRU
Oracle Corp. Enterprise Manager Base Platform≤ 13.2.1.0fstec_bduRU
Oracle Corp. Enterprise Manager Ops Center≤ 12.4.0fstec_bduRU
Oracle Corp. Fusion Middleware MapViewer≤ 12.2.1.3.0fstec_bduRU
Oracle Corp. Hyperion Infrastructure Technology≤ 11.1.2.4fstec_bduRU
Oracle Corp. Oracle Banking Enterprise Originations≤ 2.8.0fstec_bduRU
Oracle Corp. Oracle Banking Enterprise Originations≤ 2.7.0fstec_bduRU
Oracle Corp. Oracle Communications IP Service Activator≤ 7.4.0fstec_bduRU
Oracle Corp. Oracle Communications IP Service Activator≤ 7.3.0fstec_bduRU
Oracle Corp. Oracle Communications Session Route Manager8.2.0 → 8.2.2fstec_bduRU
Oracle Corp. Oracle FLEXCUBE Investor Servicing≤ 14.1.0fstec_bduRU
Oracle Corp. Oracle FLEXCUBE Investor Servicing≤ 14.0.0fstec_bduRU
Oracle Corp. Oracle FLEXCUBE Investor Servicing≤ 12.4.0fstec_bduRU

showing 20 of 74

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-1905IBM QRadar SIEM Komponente: Mehrere SchwachstellenDeutsch2025-08-25csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM Komponenten ausnutzen, um Daten zu manipulieren, um einen Denial of Service Angriff durchzuführen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.
WID-SEC-W-2026-0180Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Angriffe zu starten.
GHSA-84p2-vf58-xhxvBillion laughs attack in c3p02019-04-23ghsa · osvUS
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund osv NVD CVE.org MITRE

published 2019-04-22modified 2026-06-17

related (129)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2009-1955US	high7.5	53.0% (99th)	Exploit	2009-06-08
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows r…
CVE-2023-38490US	critical10.0	1.70% (77th)	Exploit	2023-07-27
Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the `Xml` data handler (e…
CVE-2019-12401US	high7.5	8.55% (95th)	Exploit	2019-09-10
Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML D…
CVE-2024-28757US	high7.5	2.01% (81st)	Exploit	2024-03-10
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
CVE-2014-2228US	critical9.8	3.31% (88th)	—	2020-02-19
The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages.

+124 more

references (33)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan