CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1831 vulnerabilities reference this CWE, most recent first.
GHSA-5CR4-4CRM-RRP5
Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-05-24 19:07Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser to access the URI and embed the contents, which may allow the attacker to disclose information that is accessible in the context of the user executing software.
{
"affected": [],
"aliases": [
"CVE-2021-32972"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-09T11:15:00Z",
"severity": "MODERATE"
},
"details": "Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser to access the URI and embed the contents, which may allow the attacker to disclose information that is accessible in the context of the user executing software.",
"id": "GHSA-5cr4-4crm-rrp5",
"modified": "2022-05-24T19:07:22Z",
"published": "2022-05-24T19:07:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32972"
},
{
"type": "WEB",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-180-03"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-5FJ4-9H5F-W6XG
Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 147630.
{
"affected": [],
"aliases": [
"CVE-2018-1727"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-15T20:29:00Z",
"severity": "CRITICAL"
},
"details": "IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 147630.",
"id": "GHSA-5fj4-9h5f-w6xg",
"modified": "2022-05-13T01:32:55Z",
"published": "2022-05-13T01:32:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1727"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/147630"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10718887"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5G9G-W9X5-3RFC
Vulnerability from github – Published: 2022-05-14 01:21 – Updated: 2022-05-14 01:21SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT,KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49,KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49. 7.73 KERNEL from 7.21 to 7.22, 7.45, 7.49, 7.53, 7.73, 7.75.
{
"affected": [],
"aliases": [
"CVE-2019-0265"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-15T18:29:00Z",
"severity": "MODERATE"
},
"details": "SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT,KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49,KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49. 7.73 KERNEL from 7.21 to 7.22, 7.45, 7.49, 7.53, 7.73, 7.75.",
"id": "GHSA-5g9g-w9x5-3rfc",
"modified": "2022-05-14T01:21:26Z",
"published": "2022-05-14T01:21:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0265"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2729710"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106972"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/107364"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5GWH-R76W-934H
Vulnerability from github – Published: 2024-01-09 09:30 – Updated: 2024-01-09 19:26Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.0.11"
},
"package": {
"ecosystem": "Maven",
"name": "com.qualys.plugins:qualys-was"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-6149"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-09T19:26:01Z",
"nvd_published_at": "2024-01-09T09:15:42Z",
"severity": "MODERATE"
},
"details": "Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data",
"id": "GHSA-5gwh-r76w-934h",
"modified": "2024-01-09T19:26:01Z",
"published": "2024-01-09T09:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6149"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/qualys-was-plugin/commit/b4eeb34747fa1b934abbdf686102f6495fdb02ee"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/qualys-was-plugin"
},
{
"type": "WEB",
"url": "https://www.qualys.com/security-advisories"
},
{
"type": "WEB",
"url": "https://www.qualys.com/security-advisories/cve-2023-6149"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Qualys Jenkins Plugin for WAS XML External Entity vulnerability"
}
GHSA-5H3X-3X9G-9C2M
Vulnerability from github – Published: 2024-10-16 18:31 – Updated: 2024-10-21 15:32Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.
{
"affected": [],
"aliases": [
"CVE-2024-4189"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-16T17:15:17Z",
"severity": "MODERATE"
},
"details": "Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.",
"id": "GHSA-5h3x-3x9g-9c2m",
"modified": "2024-10-21T15:32:26Z",
"published": "2024-10-16T18:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4189"
},
{
"type": "WEB",
"url": "https://portal.microfocus.com/s/article/KM000033547?language=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:D/RE:L/U:Green",
"type": "CVSS_V4"
}
]
}
GHSA-5H9G-8XCV-QJQ9
Vulnerability from github – Published: 2022-05-24 19:17 – Updated: 2022-06-21 20:11corenlp is vulnerable to Improper Restriction of XML External Entity Reference
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.3.0"
},
"package": {
"ecosystem": "Maven",
"name": "edu.stanford.nlp:stanford-corenlp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-3878"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-21T20:11:43Z",
"nvd_published_at": "2021-10-15T14:15:00Z",
"severity": "CRITICAL"
},
"details": "corenlp is vulnerable to Improper Restriction of XML External Entity Reference",
"id": "GHSA-5h9g-8xcv-qjq9",
"modified": "2022-06-21T20:11:43Z",
"published": "2022-05-24T19:17:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3878"
},
{
"type": "WEB",
"url": "https://github.com/stanfordnlp/corenlp/commit/e5bbe135a02a74b952396751ed3015e8b8252e99"
},
{
"type": "PACKAGE",
"url": "https://github.com/stanfordnlp/CoreNLP"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/a11c889b-ccff-4fea-9e29-963a23a63dd2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference in Stanford CoreNLP"
}
GHSA-5HG8-R9VQ-GJQP
Vulnerability from github – Published: 2022-05-13 01:07 – Updated: 2022-07-01 11:57In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.xmlgraphics:fop"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-5661"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-01T11:57:29Z",
"nvd_published_at": "2017-04-18T14:59:00Z",
"severity": "HIGH"
},
"details": "In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.",
"id": "GHSA-5hg8-r9vq-gjqp",
"modified": "2022-07-01T11:57:29Z",
"published": "2022-05-13T01:07:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5661"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2021-14"
},
{
"type": "WEB",
"url": "https://xmlgraphics.apache.org/security.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3864"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97947"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference in Apache FOP"
}
GHSA-5HQF-7QHR-WQC3
Vulnerability from github – Published: 2025-03-21 21:31 – Updated: 2025-03-21 21:31Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 (SP8).
{
"affected": [],
"aliases": [
"CVE-2025-25036"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-21T20:15:15Z",
"severity": "MODERATE"
},
"details": "Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 (SP8).",
"id": "GHSA-5hqf-7qhr-wqc3",
"modified": "2025-03-21T21:31:39Z",
"published": "2025-03-21T21:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25036"
},
{
"type": "WEB",
"url": "https://community.jalios.com/jcms/jc1_893720/en/security-alert-2025-02-19"
},
{
"type": "WEB",
"url": "https://issues.jalios.com/browse/JCMS-11250"
},
{
"type": "WEB",
"url": "https://vulncheck.com/advisories/jalios-jplatform-xxe"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5J2H-5MQ2-6HQM
Vulnerability from github – Published: 2024-05-03 03:30 – Updated: 2024-05-03 03:30LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of the copyContent command. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-20005.
{
"affected": [],
"aliases": [
"CVE-2023-40506"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T03:15:25Z",
"severity": "HIGH"
},
"details": "LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the copyContent command. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-20005.",
"id": "GHSA-5j2h-5mq2-6hqm",
"modified": "2024-05-03T03:30:59Z",
"published": "2024-05-03T03:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40506"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1210"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5M48-VR54-VMH3
Vulnerability from github – Published: 2022-05-17 19:57 – Updated: 2025-06-19 17:08jersey: XXE via parameter entities not disabled by the jersey SAX parser
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.sun.jersey:jersey-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-3643"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-19T17:08:27Z",
"nvd_published_at": "2019-12-15T22:15:00Z",
"severity": "HIGH"
},
"details": "jersey: XXE via parameter entities not disabled by the jersey SAX parser",
"id": "GHSA-5m48-vr54-vmh3",
"modified": "2025-06-19T17:08:27Z",
"published": "2022-05-17T19:57:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3643"
},
{
"type": "WEB",
"url": "https://github.com/javaee/jersey-1.x/commit/49f1e5a6ac608ccb51939205e4739f328f2223e6"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2014-3643"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3643"
},
{
"type": "PACKAGE",
"url": "https://github.com/javaee/jersey-1.x"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
},
{
"type": "WEB",
"url": "https://www.sourceclear.com/vulnerability-database/security/xml-external-entity-xxe/java/sid-22175"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "jersey: XXE via parameter entities"
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.