Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1831 vulnerabilities reference this CWE, most recent first.
GHSA-F7RQ-9QG8-CCHW
Vulnerability from github – Published: 2022-05-17 02:35 – Updated: 2022-05-17 02:35
VLAI
Details
XML external entity (XXE) vulnerability in Citrix XenMobile Server 9.x and 10.x before 10.5 RP3 allows attackers to obtain sensitive information via unspecified vectors.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2017-9231"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-16T22:29:00Z",
"severity": "HIGH"
},
"details": "XML external entity (XXE) vulnerability in Citrix XenMobile Server 9.x and 10.x before 10.5 RP3 allows attackers to obtain sensitive information via unspecified vectors.",
"id": "GHSA-f7rq-9qg8-cchw",
"modified": "2022-05-17T02:35:49Z",
"published": "2022-05-17T02:35:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9231"
},
{
"type": "WEB",
"url": "https://support.citrix.com/article/CTX220138"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98995"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038704"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F825-C4MJ-CWWX
Vulnerability from github – Published: 2022-05-13 01:10 – Updated: 2022-05-13 01:10
VLAI
Details
An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to access sensitive information.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2018-13823"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-30T14:29:00Z",
"severity": "HIGH"
},
"details": "An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to access sensitive information.",
"id": "GHSA-f825-c4mj-cwwx",
"modified": "2022-05-13T01:10:52Z",
"published": "2022-05-13T01:10:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13823"
},
{
"type": "WEB",
"url": "https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/105297"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F83Q-2CP7-QRJG
Vulnerability from github – Published: 2022-08-06 05:30 – Updated: 2024-11-18 23:02
VLAI
Summary
untangle vulnerable to Improper Restriction of XML External Entity Reference
Details
Description
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files.
Impact
An attacker may be able to read the contents of local files. This affects untangle versions up to and including 1.2.0
Patches
The problem has been fixed with version 1.2.1
Workarounds
None
References
https://jvn.jp/en/jp/JVN30454777/
For more information
If you have any questions or comments about this advisory: * Open an issue
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "untangle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31471"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-08-06T05:30:13Z",
"nvd_published_at": "2022-07-26T06:15:00Z",
"severity": "HIGH"
},
"details": "### Description\nuntangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files.\n\n### Impact\nAn attacker may be able to read the contents of local files. This affects untangle versions up to and including 1.2.0\n\n### Patches\nThe problem has been fixed with version 1.2.1\n\n### Workarounds\nNone\n\n### References\nhttps://jvn.jp/en/jp/JVN30454777/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an [issue](https://github.com/stchris/untangle/issues)\n",
"id": "GHSA-f83q-2cp7-qrjg",
"modified": "2024-11-18T23:02:45Z",
"published": "2022-08-06T05:30:13Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/stchris/untangle/security/advisories/GHSA-f83q-2cp7-qrjg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31471"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/untangle/PYSEC-2022-244.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/stchris/untangle"
},
{
"type": "WEB",
"url": "https://github.com/stchris/untangle/releases/tag/1.2.1"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN30454777"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "untangle vulnerable to Improper Restriction of XML External Entity Reference"
}
GHSA-F8FW-G78C-X8JH
Vulnerability from github – Published: 2022-05-17 02:53 – Updated: 2025-04-20 03:34
VLAI
Details
USB Pratirodh allows remote attackers to conduct XML External Entity (XXE) attacks via XML data in usb.xml.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2017-6895"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-23T20:59:00Z",
"severity": "CRITICAL"
},
"details": "USB Pratirodh allows remote attackers to conduct XML External Entity (XXE) attacks via XML data in usb.xml.",
"id": "GHSA-f8fw-g78c-x8jh",
"modified": "2025-04-20T03:34:44Z",
"published": "2022-05-17T02:53:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6895"
},
{
"type": "WEB",
"url": "https://secur1tyadvisory.wordpress.com/2017/03/15/usb-pratirodh-xml-external-entity-injection-vulnerability"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/141652/USB-Pratirodh-XXE-Injection.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2017/Mar/42"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96936"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F8HX-F4XW-C646
Vulnerability from github – Published: 2024-07-21 12:30 – Updated: 2024-11-18 16:26
VLAI
Summary
Guardrails AI vulnerable to Improper Restriction of XML External Entity Reference
Details
RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal file data via the SYSTEM entity.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "guardrails-ai"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-6961"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-22T14:44:52Z",
"nvd_published_at": "2024-07-21T11:15:03Z",
"severity": "HIGH"
},
"details": "RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal file data via the SYSTEM entity.",
"id": "GHSA-f8hx-f4xw-c646",
"modified": "2024-11-18T16:26:54Z",
"published": "2024-07-21T12:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6961"
},
{
"type": "WEB",
"url": "https://github.com/guardrails-ai/guardrails/pull/922"
},
{
"type": "WEB",
"url": "https://github.com/guardrails-ai/guardrails/commit/f3d806afee31e2e3f97af682d16c3c1bc0d3c380"
},
{
"type": "PACKAGE",
"url": "https://github.com/guardrails-ai/guardrails"
},
{
"type": "WEB",
"url": "https://research.jfrog.com/vulnerabilities/guardrails-rail-xxe-jfsa-2024-001035519"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Guardrails AI vulnerable to Improper Restriction of XML External Entity Reference"
}
GHSA-F8P4-3GJ8-2GXJ
Vulnerability from github – Published: 2026-02-17 18:32 – Updated: 2026-02-17 18:32
VLAI
Details
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2025-36247"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-17T18:20:29Z",
"severity": "HIGH"
},
"details": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.",
"id": "GHSA-f8p4-3gj8-2gxj",
"modified": "2026-02-17T18:32:58Z",
"published": "2026-02-17T18:32:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36247"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7259961"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-F8V5-2G96-J9MQ
Vulnerability from github – Published: 2023-11-06 03:30 – Updated: 2024-10-29 21:30
VLAI
Details
e-Tax software Version3.0.10 and earlier improperly restricts XML external entity references (XXE) due to the configuration of the embedded XML parser. By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-46802"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-06T02:15:07Z",
"severity": "MODERATE"
},
"details": "e-Tax software Version3.0.10 and earlier improperly restricts XML external entity references (XXE) due to the configuration of the embedded XML parser. By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.",
"id": "GHSA-f8v5-2g96-j9mq",
"modified": "2024-10-29T21:30:43Z",
"published": "2023-11-06T03:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46802"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN14762986"
},
{
"type": "WEB",
"url": "https://www.e-tax.nta.go.jp/topics/topics_20231102.htm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F8V8-JQRR-5MHQ
Vulnerability from github – Published: 2024-11-27 00:31 – Updated: 2024-11-27 00:31
VLAI
Details
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.
Severity
7.3 (High)
{
"affected": [],
"aliases": [
"CVE-2024-53674"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-91"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T22:15:18Z",
"severity": "HIGH"
},
"details": "An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.",
"id": "GHSA-f8v8-jqrr-5mhq",
"modified": "2024-11-27T00:31:41Z",
"published": "2024-11-27T00:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53674"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbgn04731en_us"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-F93F-G33R-8PCP
Vulnerability from github – Published: 2022-05-13 01:02 – Updated: 2024-02-27 23:55
VLAI
Summary
Improper Restriction of XML External Entity Reference in Spring Framework
Details
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
Severity
8.8 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webmvc"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webmvc"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-0225"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-07T22:58:08Z",
"nvd_published_at": "2017-05-25T17:29:00Z",
"severity": "HIGH"
},
"details": "When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.",
"id": "GHSA-f93f-g33r-8pcp",
"modified": "2024-02-27T23:55:20Z",
"published": "2022-05-13T01:02:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0225"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-framework/commit/44ee51a6c9c3734b3fcf9a20817117e86047d753"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-framework/commit/8e096aeef55287dc829484996c9330cf755891a1"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-framework/commit/c6503ebbf7c9e21ff022c58706dbac5417b2b5eb"
},
{
"type": "WEB",
"url": "https://jira.spring.io/browse/SPR-11768"
},
{
"type": "WEB",
"url": "https://pivotal.io/security/cve-2014-0225"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference in Spring Framework"
}
GHSA-FC4V-2946-8QGV
Vulnerability from github – Published: 2022-05-14 03:01 – Updated: 2022-05-14 03:01
VLAI
Details
ONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in providers/netconf/alarm/src/main/java/org/onosproject/provider/netconf/alarm/NetconfAlarmTranslator.java that can result in An adversary can remotely launch advanced XXE attacks on ONOS controller without authentication.. This attack appear to be exploitable via crafted protocol message.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2018-1000614"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-09T20:29:00Z",
"severity": "CRITICAL"
},
"details": "ONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in providers/netconf/alarm/src/main/java/org/onosproject/provider/netconf/alarm/NetconfAlarmTranslator.java that can result in An adversary can remotely launch advanced XXE attacks on ONOS controller without authentication.. This attack appear to be exploitable via crafted protocol message.",
"id": "GHSA-fc4v-2946-8qgv",
"modified": "2022-05-14T03:01:32Z",
"published": "2022-05-14T03:01:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000614"
},
{
"type": "WEB",
"url": "https://gerrit.onosproject.org/#/c/18779"
},
{
"type": "WEB",
"url": "http://gms.cl0udz.com/ONOS_Vul.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.