Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1710 vulnerabilities reference this CWE, most recent first.
GHSA-G4HQ-749C-P7FV
Vulnerability from github – Published: 2022-05-17 02:54 – Updated: 2022-05-17 02:54
VLAI
Details
XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2016-4931"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-20T20:59:00Z",
"severity": "MODERATE"
},
"details": "XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service.",
"id": "GHSA-g4hq-749c-p7fv",
"modified": "2022-05-17T02:54:28Z",
"published": "2022-05-17T02:54:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4931"
},
{
"type": "WEB",
"url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10760"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93540"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G4R8-28FP-F255
Vulnerability from github – Published: 2023-01-05 12:30 – Updated: 2024-02-13 21:47
VLAI
Summary
aXMLRPC XML External Entity vulnerability
Details
A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.12.1 is able to address this issue. The name of the patch is ad6615b3ec41353e614f6ea5fdd5b046442a832b. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "fr.turri:aXMLRPC"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.12.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-36641"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-11T23:48:32Z",
"nvd_published_at": "2023-01-05T12:15:00Z",
"severity": "CRITICAL"
},
"details": "A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function `ResponseParser` of the file `src/main/java/de/timroes/axmlrpc/ResponseParser.java`. The manipulation leads to xml external entity reference. Upgrading to version 1.12.1 is able to address this issue. The name of the patch is ad6615b3ec41353e614f6ea5fdd5b046442a832b. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.",
"id": "GHSA-g4r8-28fp-f255",
"modified": "2024-02-13T21:47:52Z",
"published": "2023-01-05T12:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36641"
},
{
"type": "WEB",
"url": "https://github.com/gturri/aXMLRPC/commit/456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae"
},
{
"type": "WEB",
"url": "https://github.com/gturri/aXMLRPC/commit/ad6615b3ec41353e614f6ea5fdd5b046442a832b"
},
{
"type": "PACKAGE",
"url": "https://github.com/gturri/aXMLRPC"
},
{
"type": "WEB",
"url": "https://github.com/gturri/aXMLRPC/releases/tag/aXMLRPC-1.12.1"
},
{
"type": "WEB",
"url": "https://github.com/gturri/aXMLRPC/releases/tag/aXMLRPC-1.14.0"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.217450"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.217450"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "aXMLRPC XML External Entity vulnerability"
}
GHSA-G536-463C-Q7R3
Vulnerability from github – Published: 2025-06-30 21:30 – Updated: 2025-09-24 21:30
VLAI
Details
Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.
Severity
5.8 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-49493"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-30T20:15:25Z",
"severity": "MODERATE"
},
"details": "Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.",
"id": "GHSA-g536-463c-q7r3",
"modified": "2025-09-24T21:30:31Z",
"published": "2025-06-30T21:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49493"
},
{
"type": "WEB",
"url": "https://github.com/SystemVll/CVE-2025-49493"
},
{
"type": "WEB",
"url": "https://techdocs.akamai.com/cloudtest/changelog/june-2-2025-enhancements-and-bug-fixes"
},
{
"type": "WEB",
"url": "https://www.akamai.com/products/cloudtest"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G556-X5VX-QH59
Vulnerability from github – Published: 2018-10-19 16:50 – Updated: 2022-09-14 19:15
VLAI
Summary
Android SVG vulnerable to XML External Entity (XXE)
Details
AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution
Severity
7.8 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.caverock:androidsvg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-1000498"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:36:09Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution",
"id": "GHSA-g556-x5vx-qh59",
"modified": "2022-09-14T19:15:38Z",
"published": "2018-10-19T16:50:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000498"
},
{
"type": "WEB",
"url": "https://github.com/BigBadaboom/androidsvg/issues/122"
},
{
"type": "PACKAGE",
"url": "https://github.com/BigBadaboom/androidsvg"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-g556-x5vx-qh59"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Android SVG vulnerable to XML External Entity (XXE)"
}
GHSA-G558-H4G7-Q46J
Vulnerability from github – Published: 2022-05-13 01:14 – Updated: 2022-05-13 01:14
VLAI
Details
Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting in denial of service and possibly remote code execution
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2017-1000497"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-03T14:29:00Z",
"severity": "CRITICAL"
},
"details": "Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting in denial of service and possibly remote code execution",
"id": "GHSA-g558-h4g7-q46j",
"modified": "2022-05-13T01:14:30Z",
"published": "2022-05-13T01:14:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000497"
},
{
"type": "WEB",
"url": "https://github.com/sbrl/Pepperminty-Wiki/issues/152"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G5JF-3PR8-VJWM
Vulnerability from github – Published: 2022-05-17 02:35 – Updated: 2022-05-17 02:35
VLAI
Details
An XML External Entity (XXE) issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET), exploitable by sending a crafted standard-conforming OSCI message from within the infrastructure.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2017-10670"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-30T12:29:00Z",
"severity": "CRITICAL"
},
"details": "An XML External Entity (XXE) issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET), exploitable by sending a crafted standard-conforming OSCI message from within the infrastructure.",
"id": "GHSA-g5jf-3pr8-vjwm",
"modified": "2022-05-17T02:35:51Z",
"published": "2022-05-17T02:35:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10670"
},
{
"type": "WEB",
"url": "http://blog.sec-consult.com/2017/06/german-e-government-details-vulnerabilities.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2017/Jun/44"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G5MJ-C26G-VMPM
Vulnerability from github – Published: 2023-01-26 21:30 – Updated: 2023-02-03 20:36
VLAI
Summary
XML Entity Expansion in Jenkins TestComplete support Plugin
Details
Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Severity
9.8 (Critical)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.8.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:TestComplete"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-24443"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-27T01:00:03Z",
"nvd_published_at": "2023-01-26T21:18:00Z",
"severity": "CRITICAL"
},
"details": "Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.",
"id": "GHSA-g5mj-c26g-vmpm",
"modified": "2023-02-03T20:36:33Z",
"published": "2023-01-26T21:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24443"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/testcomplete-plugin/commit/971003ea578a090ed9a5b9487acb9d2aa93645d3"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/testcomplete-plugin/commit/cfb0fc3cd807cb72c24424cef98ce39710f2e5fb"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2741"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XML Entity Expansion in Jenkins TestComplete support Plugin"
}
GHSA-G5WV-8CPQ-H4X2
Vulnerability from github – Published: 2022-05-14 01:36 – Updated: 2022-05-14 01:36
VLAI
Details
In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete compromise of the ClearPass instance if an attacker knows of the existence of these accounts.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2018-7063"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-07T21:29:00Z",
"severity": "HIGH"
},
"details": "In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete compromise of the ClearPass instance if an attacker knows of the existence of these accounts.",
"id": "GHSA-g5wv-8cpq-h4x2",
"modified": "2022-05-14T01:36:39Z",
"published": "2022-05-14T01:36:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7063"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G6H2-4X64-C59X
Vulnerability from github – Published: 2022-05-24 16:47 – Updated: 2024-05-30 14:15
VLAI
Summary
Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin
Details
An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.
Severity
7.5 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.7"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:token-macro"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-10337"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-28T23:09:04Z",
"nvd_published_at": "2019-06-11T14:29:00Z",
"severity": "HIGH"
},
"details": "An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the \"XML\" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.",
"id": "GHSA-g6h2-4x64-c59x",
"modified": "2024-05-30T14:15:27Z",
"published": "2022-05-24T16:47:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10337"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/token-macro-plugin/commit/004319f1b6e2a0f097a096b9df9dc19a5ac0d9b0"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1636"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1851"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/token-macro-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1399"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/06/11/1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/108747"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin"
}
GHSA-G6RC-H7GR-54HR
Vulnerability from github – Published: 2022-05-24 16:59 – Updated: 2024-04-04 02:35
VLAI
Details
An XML External Entity Injection vulnerability exists in Dzone AnswerHub.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2017-15725"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-28T19:15:00Z",
"severity": "HIGH"
},
"details": "An XML External Entity Injection vulnerability exists in Dzone AnswerHub.",
"id": "GHSA-g6rc-h7gr-54hr",
"modified": "2024-04-04T02:35:27Z",
"published": "2022-05-24T16:59:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15725"
},
{
"type": "WEB",
"url": "https://il.linkedin.com/in/nivlevy"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.