CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1710 vulnerabilities reference this CWE, most recent first.
GHSA-G939-WPMQ-66Q4
Vulnerability from github – Published: 2022-05-14 01:53 – Updated: 2022-05-14 01:53FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection.
{
"affected": [],
"aliases": [
"CVE-2018-16252"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-05T21:29:00Z",
"severity": "LOW"
},
"details": "FsPro Labs Event Log Explorer 4.6.1.2115 has \".elx\" FileType XML External Entity Injection.",
"id": "GHSA-g939-wpmq-66q4",
"modified": "2022-05-14T01:53:17Z",
"published": "2022-05-14T01:53:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16252"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/45319"
},
{
"type": "WEB",
"url": "http://hyp3rlinx.altervista.org/advisories/FSPRO-LABS-EVENT-LOG-EXPLORER-XML-INJECTION-INFO-DISCLOSURE.txt"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/149195/FsPro-Labs-Event-Log-Explorer-4.6.1.2115-XML-Injection.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G945-CXXH-JXH9
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-05-24 19:03IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197793.
{
"affected": [],
"aliases": [
"CVE-2021-20492"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-26T17:15:00Z",
"severity": "HIGH"
},
"details": "IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197793.",
"id": "GHSA-g945-cxxh-jxh9",
"modified": "2022-05-24T19:03:20Z",
"published": "2022-05-24T19:03:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20492"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/197793"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6456017"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-G9HG-X9C9-7XGR
Vulnerability from github – Published: 2022-05-24 17:35 – Updated: 2023-10-27 13:17Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers able to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Jenkins CVS Plugin 2.17 disables external entity resolution for its XML parser.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.16"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:cvs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.17"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2324"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-16T22:56:27Z",
"nvd_published_at": "2020-12-03T16:15:00Z",
"severity": "HIGH"
},
"details": "Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers able to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.\n\nJenkins CVS Plugin 2.17 disables external entity resolution for its XML parser.",
"id": "GHSA-g9hg-x9c9-7xgr",
"modified": "2023-10-27T13:17:26Z",
"published": "2022-05-24T17:35:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2324"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/cvs-plugin/commit/ff121443b282c8dbd6a5ee4841f152f78e4a5954"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/cvs-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2146"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/12/03/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in Jenkins CVS Plugin"
}
GHSA-GCG5-H35M-25RV
Vulnerability from github – Published: 2024-11-12 21:30 – Updated: 2024-11-22 21:32XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence
{
"affected": [],
"aliases": [
"CVE-2024-10218"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T20:15:05Z",
"severity": "CRITICAL"
},
"details": "XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility),\u00a0monitoringconsolecommon.jar\u00a0in TIBCO Software Inc\u00a0TIBCO Hawk and\u00a0TIBCO Operational Intelligence",
"id": "GHSA-gcg5-h35m-25rv",
"modified": "2024-11-22T21:32:12Z",
"published": "2024-11-12T21:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10218"
},
{
"type": "WEB",
"url": "https://community.tibco.com/advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:L/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:X/U:Green",
"type": "CVSS_V4"
}
]
}
GHSA-GCHV-364H-R896
Vulnerability from github – Published: 2022-05-06 00:00 – Updated: 2023-10-13 21:07A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 only. Apache Jena 4.2.x and 4.3.x do not allow external entities.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.jena:jena"
},
"ranges": [
{
"events": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.5.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.4.0"
]
}
],
"aliases": [
"CVE-2022-28890"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-05-24T20:52:33Z",
"nvd_published_at": "2022-05-05T09:15:00Z",
"severity": "CRITICAL"
},
"details": "A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 only. Apache Jena 4.2.x and 4.3.x do not allow external entities.",
"id": "GHSA-gchv-364h-r896",
"modified": "2023-10-13T21:07:20Z",
"published": "2022-05-06T00:00:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28890"
},
{
"type": "PACKAGE",
"url": "https://gitbox.apache.org/repos/asf/jena.git"
},
{
"type": "WEB",
"url": "https://jena.apache.org/about_jena/security-advisories.html#cve-2022-28890---processing-external-dtds"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XML External Entity Reference in apache jena"
}
GHSA-GCMC-57W6-9878
Vulnerability from github – Published: 2025-07-29 09:31 – Updated: 2025-07-29 09:31SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files.
{
"affected": [],
"aliases": [
"CVE-2025-26400"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-29T08:15:26Z",
"severity": "MODERATE"
},
"details": "SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files.",
"id": "GHSA-gcmc-57w6-9878",
"modified": "2025-07-29T09:31:12Z",
"published": "2025-07-29T09:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26400"
},
{
"type": "WEB",
"url": "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7_release_notes.htm"
},
{
"type": "WEB",
"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26400"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GCP6-QPVH-GGVF
Vulnerability from github – Published: 2022-05-24 17:05 – Updated: 2024-04-04 02:45Easy XML Editor through v1.7.8 is affected by: XML External Entity Injection. The impact is: Arbitrary File Read and DoS by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload.
{
"affected": [],
"aliases": [
"CVE-2019-19031"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-91"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-30T20:15:00Z",
"severity": "HIGH"
},
"details": "Easy XML Editor through v1.7.8 is affected by: XML External Entity Injection. The impact is: Arbitrary File Read and DoS by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload.",
"id": "GHSA-gcp6-qpvh-ggvf",
"modified": "2024-04-04T02:45:54Z",
"published": "2022-05-24T17:05:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19031"
},
{
"type": "WEB",
"url": "https://hackpuntes.com/cve-2019-19031-easy-xml-editor-1-7-8-inyeccion-xml"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/155996/Easy-XML-Editor-1.7.8-XML-Injection.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GCQM-MJ95-PMJX
Vulnerability from github – Published: 2022-10-15 12:01 – Updated: 2022-10-15 12:01Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.
{
"affected": [],
"aliases": [
"CVE-2022-38419"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-14T20:15:00Z",
"severity": "MODERATE"
},
"details": "Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference (\u0027XXE\u0027) vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.",
"id": "GHSA-gcqm-mj95-pmjx",
"modified": "2022-10-15T12:01:01Z",
"published": "2022-10-15T12:01:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38419"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb22-44.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GCX3-8MJ9-XGM6
Vulnerability from github – Published: 2022-05-24 19:19 – Updated: 2022-05-24 19:19Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition to the other servers by processing a specially crafted XML document.
{
"affected": [],
"aliases": [
"CVE-2021-20839"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-01T02:15:00Z",
"severity": "MODERATE"
},
"details": "Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition to the other servers by processing a specially crafted XML document.",
"id": "GHSA-gcx3-8mj9-xgm6",
"modified": "2022-05-24T19:19:22Z",
"published": "2022-05-24T19:19:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20839"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN33453839/index.html"
},
{
"type": "WEB",
"url": "https://www.antenna.co.jp/news/2021/osdc72-20211027.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GCXJ-MHMW-GGHW
Vulnerability from github – Published: 2022-05-17 02:41 – Updated: 2022-05-17 02:41IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1999960.
{
"affected": [],
"aliases": [
"CVE-2016-9698"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-08T21:29:00Z",
"severity": "HIGH"
},
"details": "IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1999960.",
"id": "GHSA-gcxj-mhmw-gghw",
"modified": "2022-05-17T02:41:26Z",
"published": "2022-05-17T02:41:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9698"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/119522"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg21999960"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg22002258"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96829"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.