Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1831 vulnerabilities reference this CWE, most recent first.
GHSA-WHX2-VVVV-HM68
Vulnerability from github – Published: 2023-06-14 00:30 – Updated: 2024-04-04 04:48
VLAI
Details
Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2023-24470"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-13T23:15:08Z",
"severity": "CRITICAL"
},
"details": "Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0.",
"id": "GHSA-whx2-vvvv-hm68",
"modified": "2024-04-04T04:48:13Z",
"published": "2023-06-14T00:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24470"
},
{
"type": "WEB",
"url": "https://portal.microfocus.com/s/article/KM000018224?language=en_US"
},
{
"type": "WEB",
"url": "https://www.microfocus.com/documentation/arcsight/logger-7.3/logger-7.3-release-notes"
},
{
"type": "WEB",
"url": "https://www.microfocus.com/support/downloads/%2C"
},
{
"type": "WEB",
"url": "https://www.microfocus.com/support/downloads/,"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WJ9Q-G585-77CQ
Vulnerability from github – Published: 2022-08-06 00:00 – Updated: 2022-08-12 00:01
VLAI
Details
Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2022-1704"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-05T16:15:00Z",
"severity": "CRITICAL"
},
"details": "Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup.",
"id": "GHSA-wj9q-g585-77cq",
"modified": "2022-08-12T00:01:24Z",
"published": "2022-08-06T00:00:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1704"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WJP3-QMQC-27MC
Vulnerability from github – Published: 2022-04-21 00:00 – Updated: 2022-04-29 00:00
VLAI
Details
The affected product is vulnerable to a network-based attack by threat actors supplying a crafted, malicious XML payload designed to trigger an external entity reference call.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-43990"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-20T16:15:00Z",
"severity": "MODERATE"
},
"details": "The affected product is vulnerable to a network-based attack by threat actors supplying a crafted, malicious XML payload designed to trigger an external entity reference call.",
"id": "GHSA-wjp3-qmqc-27mc",
"modified": "2022-04-29T00:00:32Z",
"published": "2022-04-21T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43990"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WM24-PC4H-HW9Q
Vulnerability from github – Published: 2022-05-24 17:22 – Updated: 2023-01-27 21:31
VLAI
Details
In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be exploited to send the contents of local files to a remote server when edited or validated, even when external entity resolution is disabled in the user preferences.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2019-17637"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-07-15T15:15:00Z",
"severity": "MODERATE"
},
"details": "In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be exploited to send the contents of local files to a remote server when edited or validated, even when external entity resolution is disabled in the user preferences.",
"id": "GHSA-wm24-pc4h-hw9q",
"modified": "2023-01-27T21:31:11Z",
"published": "2022-05-24T17:22:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17637"
},
{
"type": "WEB",
"url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00016.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WMH6-WH26-4MJ9
Vulnerability from github – Published: 2023-12-19 18:30 – Updated: 2023-12-19 18:30
VLAI
Details
An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF).
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-46265"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-19T16:15:11Z",
"severity": "MODERATE"
},
"details": "An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF).",
"id": "GHSA-wmh6-wh26-4mj9",
"modified": "2023-12-19T18:30:31Z",
"published": "2023-12-19T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46265"
},
{
"type": "WEB",
"url": "https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-WMHW-HPWH-44PG
Vulnerability from github – Published: 2022-05-14 01:14 – Updated: 2024-04-12 22:03
VLAI
Summary
Apache ActiveMQ Apollo XXE Vulnerability
Details
XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:apollo-project"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.7.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-3579"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-09-25T14:51:14Z",
"nvd_published_at": "2017-10-27T19:29:00Z",
"severity": "CRITICAL"
},
"details": "XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.",
"id": "GHSA-wmhw-hpwh-44pg",
"modified": "2024-04-12T22:03:42Z",
"published": "2022-05-14T01:14:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3579"
},
{
"type": "WEB",
"url": "https://github.com/apache/activemq-apollo/commit/e5647554e6801a522c508a8eb457979a9af8c398"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100721"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/activemq-apollo"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/APLO-366"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20150213000202/http://seclists.org/oss-sec/2015/q1/428"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200228080433/http://www.securityfocus.com/bid/72508"
},
{
"type": "WEB",
"url": "http://activemq.apache.org/security-advisories.data/CVE-2014-3579-announcement.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Apache ActiveMQ Apollo XXE Vulnerability"
}
GHSA-WP2F-HRG2-3R5M
Vulnerability from github – Published: 2022-05-14 00:58 – Updated: 2022-07-01 19:32
VLAI
Summary
Improper Restriction of XML External Entity Reference in Apache uimaj
Details
In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.uima:uimafit-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.uima:uimaj-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.0.0-alpha02"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.uima:uimaj-core"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0-alpha"
},
{
"fixed": "3.0.0-beta"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.uima:uimaj-as-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-15691"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-01T19:32:51Z",
"nvd_published_at": "2018-04-26T17:29:00Z",
"severity": "MODERATE"
},
"details": "In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content.",
"id": "GHSA-wp2f-hrg2-3r5m",
"modified": "2022-07-01T19:32:51Z",
"published": "2022-05-14T00:58:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15691"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1545"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/00407c65738e625a8cc9d732923a4ab2d8299603cc7c7e5cc2da9c79@%3Ccommits.uima.apache.org%3E"
},
{
"type": "WEB",
"url": "https://uima.apache.org/security_report#CVE-2017-15691"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference in Apache uimaj"
}
GHSA-WP35-6JQV-R33M
Vulnerability from github – Published: 2022-05-14 01:53 – Updated: 2023-07-28 18:41
VLAI
Summary
Apache XML-RPC XXE Vulnerability
Details
XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.
Severity
7.8 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.xmlrpc:xmlrpc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-5002"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-28T18:41:18Z",
"nvd_published_at": "2017-10-27T18:29:00Z",
"severity": "HIGH"
},
"details": "XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.",
"id": "GHSA-wp35-6jqv-r33m",
"modified": "2023-07-28T18:41:18Z",
"published": "2022-05-14T01:53:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5002"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3768"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/115042"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202401-26"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20210123151805/http://www.securityfocus.com/bid/91736"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20211021044107/http://www.securitytracker.com/id/1036294"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20230520164025/https://0ang3el.blogspot.com/2016/07/beware-of-ws-xmlrpc-library-in-your.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/07/12/5"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/91736"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1036294"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Apache XML-RPC XXE Vulnerability"
}
GHSA-WP5V-R46F-CRQ6
Vulnerability from github – Published: 2026-08-19 15:32 – Updated: 2026-08-19 15:32
VLAI
Details
Dell Command Update (DCU), versions prior to 5.7.1, contain an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and Server-side request forgery.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-67268"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-19T15:17:51Z",
"severity": "MODERATE"
},
"details": "Dell Command Update (DCU), versions prior to 5.7.1, contain an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and Server-side request forgery.",
"id": "GHSA-wp5v-r46f-crq6",
"modified": "2026-08-19T15:32:39Z",
"published": "2026-08-19T15:32:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67268"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000501378/dsa-2026-309-security-update-for-dell-command-update-for-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WPC5-5W3X-GFQH
Vulnerability from github – Published: 2022-05-13 01:35 – Updated: 2022-05-13 01:35
VLAI
Details
A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band XML External Entity (XXE) injection. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to the ability of an attacker to perform an out-of-band XXE injection on the system, which could allow an attacker to capture customer files and redirect them to another destination address. An exploit could allow the attacker to discover sensitive customer data. Cisco Bug IDs: CSCvg36996.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-0108"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-18T06:29:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band XML External Entity (XXE) injection. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to the ability of an attacker to perform an out-of-band XXE injection on the system, which could allow an attacker to capture customer files and redirect them to another destination address. An exploit could allow the attacker to discover sensitive customer data. Cisco Bug IDs: CSCvg36996.",
"id": "GHSA-wpc5-5w3x-gfqh",
"modified": "2022-05-13T01:35:48Z",
"published": "2022-05-13T01:35:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0108"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wms"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102720"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040238"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.