Common Weakness Enumeration

CWE-611

Allowed

Improper Restriction of XML External Entity Reference

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

1710 vulnerabilities reference this CWE, most recent first.

GHSA-G6V7-VQHX-6V6C

Vulnerability from github – Published: 2021-10-12 17:23 – Updated: 2021-10-18 13:50
VLAI
Summary
XML External Entity Reference in org.opencms:opencms-core
Details

An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.0.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.opencms:opencms-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0"
            },
            {
              "fixed": "12.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-3312"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-11T18:55:10Z",
    "nvd_published_at": "2021-10-08T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server\u0027s file system by uploading a crafted SVG document.",
  "id": "GHSA-g6v7-vqhx-6v6c",
  "modified": "2021-10-18T13:50:38Z",
  "published": "2021-10-12T17:23:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3312"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alkacon/opencms-core/issues/721"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alkacon/opencms-core/issues/725"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alkacon/opencms-core/commit/92e035423aa6967822d343e54392d4291648c0ee"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/alkacon/opencms-core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alkacon/opencms-core/releases"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XML External Entity Reference in org.opencms:opencms-core"
}

GHSA-G6WM-2V64-WQ36

Vulnerability from github – Published: 2025-03-10 18:24 – Updated: 2025-03-14 20:29
VLAI
Summary
LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection
Details

Description

The LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity (XXE) injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service's XML parser is configured to resolve external entities. This allows an attacker to declare an external entity that references an internal URL, which the server will then attempt to fetch when parsing the XML.

The vulnerability specifically occurs in the location constraint processing, where the XML parser resolves external entities without proper validation or restrictions. When the external entity is resolved, the server makes an HTTP request to the specified URL and includes the response content in the parsed XML document.

This vulnerability can be exploited to perform server-side request forgery (SSRF) attacks, allowing an attacker to make requests to internal services or resources that should not be accessible from external networks. The server will include the responses from these internal requests in the resulting bucket configuration, effectively leaking sensitive information.

Steps to Reproduce

  1. Create an XML document that includes an external entity declaration pointing to the internal target:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [ <!ENTITY xxe SYSTEM "http://internal-web/flag.txt"> ]>
<CreateBucketConfiguration>
    <LocationConstraint>&xxe;</LocationConstraint>
</CreateBucketConfiguration>
  1. Send a PUT request to create a new bucket with this configuration:
curl -X PUT http://app/test-bucket-2 -H 'Content-Type: application/xml' -d @payload.xml
  1. Retrieve the bucket location to see the resolved entity content:
curl http://app/test-bucket-2/?location

When these steps are executed, the server processes the XML, resolves the external entity by making a request to the internal URL, and includes the response in the bucket's location constraint. The attacker can then retrieve this information through the bucket location endpoint.

Mitigations

  • Disable XML external entity resolution in the XML parser configuration. Most XML parsers have options to disable external entity processing.
  • Implement proper input validation for XML documents, rejecting those that contain DOCTYPE declarations or external entity references.
  • Use XML parsers that are configured securely by default and don't process external entities.
  • If external entity processing is required, implement a whitelist of allowed URLs and validate all URLs before making any requests.

Impact

The vulnerability allows unauthenticated attackers to make the server perform HTTP requests to internal networks and services, potentially exposing sensitive information or enabling further attacks against internal systems. The attacker only needs to be able to send HTTP requests to the LocalS3 service to exploit this vulnerability.

Severity
5.5 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.github.robothy:local-s3-rest"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-27136"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-10T18:24:35Z",
    "nvd_published_at": "2025-03-10T19:15:40Z",
    "severity": "MODERATE"
  },
  "details": "## Description\n\nThe LocalS3 service\u0027s bucket creation endpoint is vulnerable to XML External Entity (XXE) injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service\u0027s XML parser is configured to resolve external entities. This allows an attacker to declare an external entity that references an internal URL, which the server will then attempt to fetch when parsing the XML.\n\nThe vulnerability specifically occurs in the location constraint processing, where the XML parser resolves external entities without proper validation or restrictions. When the external entity is resolved, the server makes an HTTP request to the specified URL and includes the response content in the parsed XML document.\n\nThis vulnerability can be exploited to perform server-side request forgery (SSRF) attacks, allowing an attacker to make requests to internal services or resources that should not be accessible from external networks. The server will include the responses from these internal requests in the resulting bucket configuration, effectively leaking sensitive information.\n\n## Steps to Reproduce\n\n1. Create an XML document that includes an external entity declaration pointing to the internal target:\n```xml\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003c!DOCTYPE test [ \u003c!ENTITY xxe SYSTEM \"http://internal-web/flag.txt\"\u003e ]\u003e\n\u003cCreateBucketConfiguration\u003e\n    \u003cLocationConstraint\u003e\u0026xxe;\u003c/LocationConstraint\u003e\n\u003c/CreateBucketConfiguration\u003e\n```\n\n2. Send a PUT request to create a new bucket with this configuration:\n```bash\ncurl -X PUT http://app/test-bucket-2 -H \u0027Content-Type: application/xml\u0027 -d @payload.xml\n```\n\n3. Retrieve the bucket location to see the resolved entity content:\n```bash\ncurl http://app/test-bucket-2/?location\n```\n\nWhen these steps are executed, the server processes the XML, resolves the external entity by making a request to the internal URL, and includes the response in the bucket\u0027s location constraint. The attacker can then retrieve this information through the bucket location endpoint.\n\n## Mitigations\n\n- Disable XML external entity resolution in the XML parser configuration. Most XML parsers have options to disable external entity processing.\n- Implement proper input validation for XML documents, rejecting those that contain DOCTYPE declarations or external entity references.\n- Use XML parsers that are configured securely by default and don\u0027t process external entities.\n- If external entity processing is required, implement a whitelist of allowed URLs and validate all URLs before making any requests.\n\n## Impact\n\nThe vulnerability allows unauthenticated attackers to make the server perform HTTP requests to internal networks and services, potentially exposing sensitive information or enabling further attacks against internal systems. The attacker only needs to be able to send HTTP requests to the LocalS3 service to exploit this vulnerability.",
  "id": "GHSA-g6wm-2v64-wq36",
  "modified": "2025-03-14T20:29:09Z",
  "published": "2025-03-10T18:24:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Robothy/local-s3/security/advisories/GHSA-g6wm-2v64-wq36"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27136"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Robothy/local-s3/commit/d6ed756ceb30c1eb9d4263321ac683d734f8836f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Robothy/local-s3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection"
}

GHSA-G7QQ-6W8P-G7FM

Vulnerability from github – Published: 2022-05-14 01:38 – Updated: 2022-05-14 01:38
VLAI
Details

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.

Severity
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-18980"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-11-06T04:29:00Z",
    "severity": "HIGH"
  },
  "details": "An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.",
  "id": "GHSA-g7qq-6w8p-g7fm",
  "modified": "2022-05-14T01:38:17Z",
  "published": "2022-05-14T01:38:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18980"
    },
    {
      "type": "WEB",
      "url": "https://github.com/x-f1v3/ForCve/issues/5"
    },
    {
      "type": "WEB",
      "url": "https://www.manageengine.com/network-monitoring/help/read-me.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G7W4-R4MG-GVHX

Vulnerability from github – Published: 2022-05-24 17:12 – Updated: 2022-12-22 14:05
VLAI
Summary
XXE vulnerability in Jenkins RapidDeploy Plugin
Details

RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows a user able to control the input files for the 'RapidDeploy deployment package build' build or post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks.

RapidDeploy Plugin 4.2.1 disables external entity resolution for its XML parser.

Severity
7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:rapiddeploy-jenkins"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-2171"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-22T14:05:19Z",
    "nvd_published_at": "2020-03-25T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows a user able to control the input files for the \u0027RapidDeploy deployment package build\u0027 build or post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks.\n\nRapidDeploy Plugin 4.2.1 disables external entity resolution for its XML parser.",
  "id": "GHSA-g7w4-r4mg-gvhx",
  "modified": "2022-12-22T14:05:19Z",
  "published": "2022-05-24T17:12:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2171"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/rapiddeploy-plugin"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1677"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/03/25/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XXE vulnerability in Jenkins RapidDeploy Plugin"
}

GHSA-G822-3V64-2VPM

Vulnerability from github – Published: 2023-03-21 15:30 – Updated: 2023-03-24 21:30
VLAI
Details

IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-27874"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-21T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845.",
  "id": "GHSA-g822-3v64-2vpm",
  "modified": "2023-03-24T21:30:54Z",
  "published": "2023-03-21T15:30:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27874"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/249845"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6964694"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G83J-RJQ4-8487

Vulnerability from github – Published: 2022-09-14 00:00 – Updated: 2022-09-18 00:00
VLAI
Details

Safe Software FME Server v2022.0.1.1 and below was discovered to contain a XML External Entity (XXE) vulnerability which allows authenticated attackers to perform data exfiltration or Server-Side Request Forgery (SSRF) attacks.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-38342"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-13T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Safe Software FME Server v2022.0.1.1 and below was discovered to contain a XML External Entity (XXE) vulnerability which allows authenticated attackers to perform data exfiltration or Server-Side Request Forgery (SSRF) attacks.",
  "id": "GHSA-g83j-rjq4-8487",
  "modified": "2022-09-18T00:00:35Z",
  "published": "2022-09-14T00:00:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38342"
    },
    {
      "type": "WEB",
      "url": "https://community.safe.com/s/article/Known-Issue-FME-Server-XXE-vulnerability-via-adding-a-repository-item"
    },
    {
      "type": "WEB",
      "url": "https://community.safe.com/s/article/Known-Issue-FME-Server-vulnerability-with-arbitrary-path-traversal-and-file-upload"
    },
    {
      "type": "WEB",
      "url": "https://www.cycura.com/blog/safe-software-inc-fme-server-vulnerability-disclosure"
    },
    {
      "type": "WEB",
      "url": "http://fme.com"
    },
    {
      "type": "WEB",
      "url": "http://safe.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G848-PPPP-VG6F

Vulnerability from github – Published: 2022-11-23 18:30 – Updated: 2025-04-28 21:30
VLAI
Details

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-40304"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-415",
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-23T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.",
  "id": "GHSA-g848-pppp-vg6f",
  "modified": "2025-04-28T21:30:38Z",
  "published": "2022-11-23T18:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40304"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20221209-0003"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT213531"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT213533"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT213534"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT213535"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT213536"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2022/Dec/21"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2022/Dec/24"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2022/Dec/25"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2022/Dec/26"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2022/Dec/27"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G89X-G6H5-52VM

Vulnerability from github – Published: 2022-04-14 00:00 – Updated: 2022-04-22 00:01
VLAI
Details

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploited to pass data from local files to a remote system controlled by an attacker. Affected Product: SCADAPack Workbench (6.6.8a and prior)

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-0221"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-13T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploited to pass data from local files to a remote system controlled by an attacker. Affected Product: SCADAPack Workbench (6.6.8a and prior)",
  "id": "GHSA-g89x-g6h5-52vm",
  "modified": "2022-04-22T00:01:08Z",
  "published": "2022-04-14T00:00:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0221"
    },
    {
      "type": "WEB",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2022-087-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G8GP-8CC3-6F2W

Vulnerability from github – Published: 2022-05-17 02:20 – Updated: 2022-05-17 02:20
VLAI
Details

XML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0, if exploited, could lead to information disclosure. Formerly ZDI-CAN-4706.

Severity
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-11390"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-08-02T21:29:00Z",
    "severity": "HIGH"
  },
  "details": "XML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0, if exploited, could lead to information disclosure. Formerly ZDI-CAN-4706.",
  "id": "GHSA-g8gp-8cc3-6f2w",
  "modified": "2022-05-17T02:20:12Z",
  "published": "2022-05-17T02:20:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11390"
    },
    {
      "type": "WEB",
      "url": "https://success.trendmicro.com/solution/1117722"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/100078"
    },
    {
      "type": "WEB",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-17-501"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G939-V35M-P2V6

Vulnerability from github – Published: 2022-07-21 00:00 – Updated: 2022-07-21 00:00
VLAI
Details

Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-32458"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-20T02:15:00Z",
    "severity": "HIGH"
  },
  "details": "Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.",
  "id": "GHSA-g939-v35m-p2v6",
  "modified": "2022-07-21T00:00:34Z",
  "published": "2022-07-21T00:00:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32458"
    },
    {
      "type": "WEB",
      "url": "https://www.chtsecurity.com/news/09757883-fea6-4aff-9e22-8ae8c4f8f7bb"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-6288-49e01-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Implementation System Configuration

Many XML parsers and validators can be configured to disable external entity expansion.

CAPEC-221: Data Serialization External Entities Blowup

This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.

← Back to the CWE list