CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1831 vulnerabilities reference this CWE, most recent first.
GHSA-8JFP-988R-JM7R
Vulnerability from github – Published: 2022-05-24 16:55 – Updated: 2024-04-04 01:55Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager (DSM).
{
"affected": [],
"aliases": [
"CVE-2019-9488"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-11T18:15:00Z",
"severity": "MODERATE"
},
"details": "Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager (DSM).",
"id": "GHSA-8jfp-988r-jm7r",
"modified": "2024-04-04T01:55:20Z",
"published": "2022-05-24T16:55:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9488"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/solution/1122900"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8MJ2-X5QQ-7M6C
Vulnerability from github – Published: 2024-10-16 18:31 – Updated: 2024-10-21 15:32Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.
{
"affected": [],
"aliases": [
"CVE-2024-4184"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-16T17:15:17Z",
"severity": "MODERATE"
},
"details": "Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.",
"id": "GHSA-8mj2-x5qq-7m6c",
"modified": "2024-10-21T15:32:26Z",
"published": "2024-10-16T18:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4184"
},
{
"type": "WEB",
"url": "https://portal.microfocus.com/s/article/KM000033540?language=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:D/RE:L/U:Green",
"type": "CVSS_V4"
}
]
}
GHSA-8MQ2-HM2C-3CCX
Vulnerability from github – Published: 2026-09-15 18:32 – Updated: 2026-09-15 18:32IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to XML external entity injection in MQRFH2 header processing.
{
"affected": [],
"aliases": [
"CVE-2026-12666"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-15T18:17:14Z",
"severity": "HIGH"
},
"details": "IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to XML external entity injection in MQRFH2 header processing.",
"id": "GHSA-8mq2-hm2c-3ccx",
"modified": "2026-09-15T18:32:34Z",
"published": "2026-09-15T18:32:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12666"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7284939"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8MQV-2M94-PJ5Q
Vulnerability from github – Published: 2022-05-14 01:10 – Updated: 2022-05-14 01:10SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML External Entity (XXE). This can cause SLDREG to, for example, continuously loop, read arbitrary files and even send local files.
{
"affected": [],
"aliases": [
"CVE-2019-0284"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-04-10T21:29:00Z",
"severity": "MODERATE"
},
"details": "SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML External Entity (XXE). This can cause SLDREG to, for example, continuously loop, read arbitrary files and even send local files.",
"id": "GHSA-8mqv-2m94-pj5q",
"modified": "2022-05-14T01:10:58Z",
"published": "2022-05-14T01:10:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0284"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2772376"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8PVC-CF88-PH2F
Vulnerability from github – Published: 2026-08-13 21:36 – Updated: 2026-08-13 21:36IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities.
{
"affected": [],
"aliases": [
"CVE-2026-18715"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T21:17:45Z",
"severity": "MODERATE"
},
"details": "IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities.",
"id": "GHSA-8pvc-cf88-ph2f",
"modified": "2026-08-13T21:36:14Z",
"published": "2026-08-13T21:36:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18715"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7283286"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8PX2-QHM8-M3PC
Vulnerability from github – Published: 2022-05-14 01:10 – Updated: 2022-05-14 01:10A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-0791, CVE-2019-0792, CVE-2019-0793.
{
"affected": [],
"aliases": [
"CVE-2019-0795"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-04-09T21:29:00Z",
"severity": "HIGH"
},
"details": "A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka \u0027MS XML Remote Code Execution Vulnerability\u0027. This CVE ID is unique from CVE-2019-0790, CVE-2019-0791, CVE-2019-0792, CVE-2019-0793.",
"id": "GHSA-8px2-qhm8-m3pc",
"modified": "2022-05-14T01:10:59Z",
"published": "2022-05-14T01:10:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0795"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0795"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/107732"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8QFC-CVJP-MGPQ
Vulnerability from github – Published: 2018-10-16 20:53 – Updated: 2021-09-07 20:29Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.ignite:ignite-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-6805"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:26:22Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.",
"id": "GHSA-8qfc-cvjp-mgpq",
"modified": "2021-09-07T20:29:22Z",
"published": "2018-10-16T20:53:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6805"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-8qfc-cvjp-mgpq"
},
{
"type": "WEB",
"url": "http://seclists.org/oss-sec/2017/q2/31"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97509"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Moderate severity vulnerability that affects org.apache.ignite:ignite-core"
}
GHSA-8QM5-3H3P-RC62
Vulnerability from github – Published: 2022-05-14 01:04 – Updated: 2022-05-14 01:04Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license.
{
"affected": [],
"aliases": [
"CVE-2018-20664"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-03T19:29:00Z",
"severity": "CRITICAL"
},
"details": "Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license.",
"id": "GHSA-8qm5-3h3p-rc62",
"modified": "2022-05-14T01:04:11Z",
"published": "2022-05-14T01:04:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20664"
},
{
"type": "WEB",
"url": "https://www.excellium-services.com/cert-xlm-advisory/cve-2018-20664"
},
{
"type": "WEB",
"url": "https://www.manageengine.com/products/self-service-password/release-notes.html#5701"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8QR5-RRW5-MQ36
Vulnerability from github – Published: 2026-09-11 00:31 – Updated: 2026-09-11 00:31An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.
{
"affected": [],
"aliases": [
"CVE-2026-84941"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-11T00:19:57Z",
"severity": "MODERATE"
},
"details": "An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.",
"id": "GHSA-8qr5-rrw5-mq36",
"modified": "2026-09-11T00:31:16Z",
"published": "2026-09-11T00:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84941"
},
{
"type": "WEB",
"url": "https://support.omadanetworks.com/en/document/133722"
},
{
"type": "WEB",
"url": "https://support.omadanetworks.com/en/download/software/omada-controller"
},
{
"type": "WEB",
"url": "https://support.omadanetworks.com/us/download/software/omada-controller"
},
{
"type": "WEB",
"url": "https://www.omadanetworks.com/en/support/download"
},
{
"type": "WEB",
"url": "https://www.omadanetworks.com/us/support/download"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8QRP-R4QJ-W49R
Vulnerability from github – Published: 2022-05-24 17:46 – Updated: 2022-05-24 17:46Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure.
{
"affected": [],
"aliases": [
"CVE-2020-6590"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-08T22:15:00Z",
"severity": "HIGH"
},
"details": "Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure.",
"id": "GHSA-8qrp-r4qj-w49r",
"modified": "2022-05-24T17:46:57Z",
"published": "2022-05-24T17:46:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6590"
},
{
"type": "WEB",
"url": "https://help.forcepoint.com/security/CVE/CVE-2020-6590.html"
},
{
"type": "WEB",
"url": "https://support.forcepoint.com/KBArticle?id=000019488"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.