Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1831 vulnerabilities reference this CWE, most recent first.
GHSA-CP83-X35V-HF28
Vulnerability from github – Published: 2023-07-13 00:30 – Updated: 2024-04-04 06:05
VLAI
Details
In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2023-20918"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-13T00:15:23Z",
"severity": "CRITICAL"
},
"details": "In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n",
"id": "GHSA-cp83-x35v-hf28",
"modified": "2024-04-04T06:05:08Z",
"published": "2023-07-13T00:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20918"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/16c604aa7c253ce5cf075368a258c0b21386160d"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/51051de4eb40bb502db448084a83fd6cbfb7d3cf"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/8418e3a017428683d173c0c82b0eb02d5b923a4e"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2023-07-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CPFF-M354-G6JW
Vulnerability from github – Published: 2025-01-18 00:30 – Updated: 2025-01-21 18:31
VLAI
Details
In multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dictionary due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2018-9375"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-17T23:15:11Z",
"severity": "HIGH"
},
"details": "In multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dictionary due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-cpff-m354-g6jw",
"modified": "2025-01-21T18:31:06Z",
"published": "2025-01-18T00:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9375"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2018-06-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CPHV-7CXW-5HCC
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2023-10-27 14:56
VLAI
Summary
XXE vulnerability in Jenkins Filesystem Trigger Plugin
Details
Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers with Job/Configure permission or otherwise able to control the contents of an XML file being polled for changes to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the polling Jenkins controller or agent, server-side request forgery, or denial-of-service attacks.
Jenkins Filesystem Trigger Plugin 0.41 disables external entity resolution for its XML parser.
Severity
8.8 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.40"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:fstrigger"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.41"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21657"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-15T17:35:15Z",
"nvd_published_at": "2021-05-25T17:15:00Z",
"severity": "HIGH"
},
"details": "Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers with Job/Configure permission or otherwise able to control the contents of an XML file being polled for changes to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the polling Jenkins controller or agent, server-side request forgery, or denial-of-service attacks.\n\nJenkins Filesystem Trigger Plugin 0.41 disables external entity resolution for its XML parser.",
"id": "GHSA-cphv-7cxw-5hcc",
"modified": "2023-10-27T14:56:59Z",
"published": "2022-05-24T19:03:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21657"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/fstrigger-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2021-05-25/#SECURITY-2339"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/05/25/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in Jenkins Filesystem Trigger Plugin"
}
GHSA-CR8H-FR86-8VFV
Vulnerability from github – Published: 2023-12-15 12:30 – Updated: 2023-12-19 20:52
VLAI
Summary
WSO2 products vulnerable to XML External Entity attack
Details
Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.
Severity
4.6 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.wso2.carbon.commons:org.wso2.carbon.ntask.core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.7.24"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.wso2.am:wso2am"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.0-beta"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.wso2.carbon.registry:org.wso2.carbon.registry.extensions"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.7.31"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.wso2.carbon.event-processing:org.wso2.carbon.event.processor.core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.wso2.carbon.analytics-common:org.wso2.carbon.event.input.adapter.core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.2.23"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.wso2.carbon.governance:org.wso2.carbon.governance.common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.8.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-6836"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-12-19T20:52:53Z",
"nvd_published_at": "2023-12-15T10:15:09Z",
"severity": "MODERATE"
},
"details": "Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.",
"id": "GHSA-cr8h-fr86-8vfv",
"modified": "2023-12-19T20:52:53Z",
"published": "2023-12-15T12:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6836"
},
{
"type": "WEB",
"url": "https://github.com/wso2/carbon-analytics-common/commit/9478336859306d3ea13b25cb386f29c183707fde"
},
{
"type": "WEB",
"url": "https://github.com/wso2/carbon-commons/commit/a08a587e3dd5146121a7b47a0fdd06ddbcd903f4"
},
{
"type": "WEB",
"url": "https://github.com/wso2/carbon-event-processing/commit/e9953afd46a45f704de341a081f710cbdfa3f975"
},
{
"type": "WEB",
"url": "https://github.com/wso2/carbon-governance/commit/ad36968d5a11d4fc35fa5cc4e8b5ae9a04e5bb4c"
},
{
"type": "WEB",
"url": "https://github.com/wso2/carbon-registry/commit/738b2a0b3e5f118527da236467ed72d9fd9ce40e"
},
{
"type": "WEB",
"url": "https://github.com/wso2/product-apim/commit/96e8f5d6566d57bbbb8d4257f6f55057a79d00b5"
},
{
"type": "WEB",
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-0716"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "WSO2 products vulnerable to XML External Entity attack"
}
GHSA-CRHM-WC96-7579
Vulnerability from github – Published: 2023-08-22 21:30 – Updated: 2023-11-04 00:30
VLAI
Details
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2022-48565"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-22T19:16:32Z",
"severity": "CRITICAL"
},
"details": "An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.",
"id": "GHSA-crhm-wc96-7579",
"modified": "2023-11-04T00:30:21Z",
"published": "2023-08-22T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48565"
},
{
"type": "WEB",
"url": "https://bugs.python.org/issue42051"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AFHYAGWBFBNUGWU6XWKBHTCV5NH77MB7"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BAYWJD576JUKLHCWKDLMJSUGTRDKPF3M"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KZRZRJHWLZ7MOJNPQBWGJVXMVYDC5BRA"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20231006-0007"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CV2M-JFC5-XX45
Vulnerability from github – Published: 2026-04-30 15:30 – Updated: 2026-05-18 00:31
VLAI
Details
Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-13971"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-30T13:16:02Z",
"severity": "HIGH"
},
"details": "Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.",
"id": "GHSA-cv2m-jfc5-xx45",
"modified": "2026-05-18T00:31:36Z",
"published": "2026-04-30T15:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13971"
},
{
"type": "WEB",
"url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-005"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2026/May/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:C/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-CV32-3W6X-V6X4
Vulnerability from github – Published: 2025-12-10 00:30 – Updated: 2025-12-10 00:30
VLAI
Details
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and data on the server. Exploitation of this issue does not require user interaction and scope is changed.
Severity
6.8 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-61821"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-10T00:16:10Z",
"severity": "MODERATE"
},
"details": "ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference (\u0027XXE\u0027) vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and data on the server. Exploitation of this issue does not require user interaction and scope is changed.",
"id": "GHSA-cv32-3w6x-v6x4",
"modified": "2025-12-10T00:30:23Z",
"published": "2025-12-10T00:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61821"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CV36-JHXC-FVCJ
Vulnerability from github – Published: 2023-08-03 03:30 – Updated: 2024-04-04 06:30
VLAI
Details
In WS-Inc J WBEM Server 4.7.4 before 4.7.5, the CIM-XML protocol adapter does not disable entity resolution. This allows context-dependent attackers to read arbitrary files or cause a denial of service, a similar issue to CVE-2013-4152.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2023-37364"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-03T03:15:10Z",
"severity": "CRITICAL"
},
"details": "In WS-Inc J WBEM Server 4.7.4 before 4.7.5, the CIM-XML protocol adapter does not disable entity resolution. This allows context-dependent attackers to read arbitrary files or cause a denial of service, a similar issue to CVE-2013-4152.",
"id": "GHSA-cv36-jhxc-fvcj",
"modified": "2024-04-04T06:30:26Z",
"published": "2023-08-03T03:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37364"
},
{
"type": "WEB",
"url": "https://ws-inc.com"
},
{
"type": "WEB",
"url": "https://ws-inc.com/security.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CVC3-MCX6-RFRH
Vulnerability from github – Published: 2022-05-24 19:17 – Updated: 2022-05-24 19:17
VLAI
Details
Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE.
{
"affected": [],
"aliases": [
"CVE-2021-38298"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-07T22:15:00Z",
"severity": "CRITICAL"
},
"details": "Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE.",
"id": "GHSA-cvc3-mcx6-rfrh",
"modified": "2022-05-24T19:17:05Z",
"published": "2022-05-24T19:17:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38298"
},
{
"type": "WEB",
"url": "https://www.manageengine.com/products/ad-manager/release-notes.html#7110"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CVFM-9587-3RG8
Vulnerability from github – Published: 2022-05-13 00:00 – Updated: 2022-05-25 00:00
VLAI
Details
XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2021-27777"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-12T22:15:00Z",
"severity": "HIGH"
},
"details": "XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references.",
"id": "GHSA-cvfm-9587-3rg8",
"modified": "2022-05-25T00:00:35Z",
"published": "2022-05-13T00:00:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27777"
},
{
"type": "WEB",
"url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0097124"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.