CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1831 vulnerabilities reference this CWE, most recent first.
GHSA-C2H8-XFHJ-J9VH
Vulnerability from github – Published: 2022-05-24 16:59 – Updated: 2024-04-04 02:35Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
{
"affected": [],
"aliases": [
"CVE-2019-8087"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-25T16:15:00Z",
"severity": "HIGH"
},
"details": "Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.",
"id": "GHSA-c2h8-xfhj-j9vh",
"modified": "2024-04-04T02:35:08Z",
"published": "2022-05-24T16:59:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8087"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C2JJ-MCXW-PM5X
Vulnerability from github – Published: 2022-05-13 01:35 – Updated: 2022-05-13 01:35SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure and retrieval of arbitrary data, arbitrary code execution (in certain situations on specific platforms), and denial of service attacks.
{
"affected": [],
"aliases": [
"CVE-2018-10600"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-24T13:29:00Z",
"severity": "CRITICAL"
},
"details": "SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure and retrieval of arbitrary data, arbitrary code execution (in certain situations on specific platforms), and denial of service attacks.",
"id": "GHSA-c2jj-mcxw-pm5x",
"modified": "2022-05-13T01:35:00Z",
"published": "2022-05-13T01:35:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10600"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-191-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C2VX-49JM-H3F6
Vulnerability from github – Published: 2018-07-16 16:50 – Updated: 2024-10-21 21:08XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.4.0"
},
"package": {
"ecosystem": "PyPI",
"name": "pysaml2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-10149"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:30:06Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.",
"id": "GHSA-c2vx-49jm-h3f6",
"modified": "2024-10-21T21:08:33Z",
"published": "2018-07-16T16:50:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10149"
},
{
"type": "WEB",
"url": "https://github.com/rohe/pysaml2/issues/366"
},
{
"type": "WEB",
"url": "https://github.com/rohe/pysaml2/pull/379"
},
{
"type": "WEB",
"url": "https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0936"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0937"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0938"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-c2vx-49jm-h3f6"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pysaml2/PYSEC-2017-25.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/rohe/pysaml2"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3759"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/01/19/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Pysaml2 does not sanitize XML responses"
}
GHSA-C3CG-MV5W-CVW8
Vulnerability from github – Published: 2022-05-24 17:08 – Updated: 2023-01-14 05:27FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.
This allows a user able to control the input files for its post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks.
FitNesse Plugin 1.31 disables external entity processing for its XML parser.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:fitnesse"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.31"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2120"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-14T05:27:19Z",
"nvd_published_at": "2020-02-12T15:15:00Z",
"severity": "HIGH"
},
"details": "FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows a user able to control the input files for its post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks.\n\nFitNesse Plugin 1.31 disables external entity processing for its XML parser.",
"id": "GHSA-c3cg-mv5w-cvw8",
"modified": "2023-01-14T05:27:19Z",
"published": "2022-05-24T17:08:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2120"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/fitnesse-plugin/commit/7a913b9ff7e5a6acb0f4f4ec88d86da79db6af77"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/fitnesse-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1751"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/02/12/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in FitNesse Plugin"
}
GHSA-C433-W259-GC4X
Vulnerability from github – Published: 2024-05-03 03:31 – Updated: 2024-05-03 03:31Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of XML files. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the current process. Was ZDI-CAN-18593.
{
"affected": [],
"aliases": [
"CVE-2023-51604"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T03:16:21Z",
"severity": "MODERATE"
},
"details": "Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XML files. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the current process. Was ZDI-CAN-18593.",
"id": "GHSA-c433-w259-gc4x",
"modified": "2024-05-03T03:31:08Z",
"published": "2024-05-03T03:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51604"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1853"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C447-RP4F-FGVJ
Vulnerability from github – Published: 2022-05-13 01:33 – Updated: 2022-05-13 01:33Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.
{
"affected": [],
"aliases": [
"CVE-2018-1077"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-14T18:29:00Z",
"severity": "HIGH"
},
"details": "Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.",
"id": "GHSA-c447-rp4f-fgvj",
"modified": "2022-05-13T01:33:34Z",
"published": "2022-05-13T01:33:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1077"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1555429"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C496-J49J-763X
Vulnerability from github – Published: 2022-05-17 02:51 – Updated: 2022-05-17 02:51IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 2000833.
{
"affected": [],
"aliases": [
"CVE-2016-6111"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-31T18:59:00Z",
"severity": "CRITICAL"
},
"details": "IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 2000833.",
"id": "GHSA-c496-j49j-763x",
"modified": "2022-05-17T02:51:55Z",
"published": "2022-05-17T02:51:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6111"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg22000833"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97244"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C49V-35FF-Q9F7
Vulnerability from github – Published: 2022-05-24 17:29 – Updated: 2024-04-22 19:00An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "devgroup/dotplant"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2020-09-14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-25750"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T19:00:49Z",
"nvd_published_at": "2020-09-18T04:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST[\u0027xml\u0027]) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.",
"id": "GHSA-c49v-35ff-q9f7",
"modified": "2024-04-22T19:00:49Z",
"published": "2022-05-24T17:29:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25750"
},
{
"type": "WEB",
"url": "https://github.com/DevGroup-ru/dotplant2/issues/400"
},
{
"type": "WEB",
"url": "https://github.com/DevGroup-ru/dotplant2/commit/fee86c7052c227762c7325eb5c2811d9323f8429"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "DotPlant2 Improper Restriction of XML External Entity Reference"
}
GHSA-C4MP-H3M2-H5MC
Vulnerability from github – Published: 2022-05-14 03:38 – Updated: 2022-11-22 19:46Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jvnet.hudson.plugins:ccm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1000054"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-22T19:46:36Z",
"nvd_published_at": "2018-02-09T23:29:00Z",
"severity": "HIGH"
},
"details": "Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.",
"id": "GHSA-c4mp-h3m2-h5mc",
"modified": "2022-11-22T19:46:36Z",
"published": "2022-05-14T03:38:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000054"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/ccm-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2018-02-05"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "Jenkins CCM Plugin vulnerable to Improper Restriction of XML External Entity Reference"
}
GHSA-C62W-57VG-XGVP
Vulnerability from github – Published: 2022-05-24 16:56 – Updated: 2024-04-04 02:00HCL AppScan Source before 9.03.13 is susceptible to XML External Entity (XXE) attacks in multiple locations. In particular, an attacker can send a specially crafted .ozasmt file to a targeted victim and ask the victim to open it. When the victim imports the .ozasmt file in AppScan Source, the content of any file in the local file system (to which the victim as read access) can be exfiltrated to a remote listener under the attacker's control. The product does not disable external XML Entity Processing, which can lead to information disclosure and denial of services attacks.
{
"affected": [],
"aliases": [
"CVE-2019-16188"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-25T17:15:00Z",
"severity": "HIGH"
},
"details": "HCL AppScan Source before 9.03.13 is susceptible to XML External Entity (XXE) attacks in multiple locations. In particular, an attacker can send a specially crafted .ozasmt file to a targeted victim and ask the victim to open it. When the victim imports the .ozasmt file in AppScan Source, the content of any file in the local file system (to which the victim as read access) can be exfiltrated to a remote listener under the attacker\u0027s control. The product does not disable external XML Entity Processing, which can lead to information disclosure and denial of services attacks.",
"id": "GHSA-c62w-57vg-xgvp",
"modified": "2024-04-04T02:00:13Z",
"published": "2022-05-24T16:56:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16188"
},
{
"type": "WEB",
"url": "https://hclpnpsupport.hcltech.com/csm?id=kb_article\u0026sys_id=0812a9961b0c885077761fc58d4bcb06"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.