CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1699 vulnerabilities reference this CWE, most recent first.
GHSA-HX54-PF28-7XCH
Vulnerability from github – Published: 2024-06-07 21:31 – Updated: 2024-10-30 21:36An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function via lxml dependency allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ebookmeta"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-37388"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-07T21:54:46Z",
"nvd_published_at": "2024-06-07T19:15:24Z",
"severity": "HIGH"
},
"details": "An XML External Entity (XXE) vulnerability in the `ebookmeta.get_metadata` function via lxml dependency allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.",
"id": "GHSA-hx54-pf28-7xch",
"modified": "2024-10-30T21:36:34Z",
"published": "2024-06-07T21:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37388"
},
{
"type": "WEB",
"url": "https://github.com/dnkorpushov/ebookmeta/issues/16#issue-2317712335"
},
{
"type": "PACKAGE",
"url": "https://github.com/dnkorpushov/ebookmeta"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "ebookmeta XML External Entity vulnerability"
}
GHSA-HXFR-CCXH-4WCM
Vulnerability from github – Published: 2022-08-02 00:00 – Updated: 2022-08-05 00:00IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228359.
{
"affected": [],
"aliases": [
"CVE-2022-31775"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-01T11:15:00Z",
"severity": "CRITICAL"
},
"details": "IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228359.",
"id": "GHSA-hxfr-ccxh-4wcm",
"modified": "2022-08-05T00:00:25Z",
"published": "2022-08-02T00:00:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31775"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/228359"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6608608"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HXJP-Q6C3-38FX
Vulnerability from github – Published: 2023-02-10 09:30 – Updated: 2024-10-14 14:14The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.nifi:nifi-ccda-processors"
},
"ranges": [
{
"events": [
{
"introduced": "1.2.0"
},
{
"fixed": "1.20.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-22832"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-10T22:41:43Z",
"nvd_published_at": "2023-02-10T08:15:00Z",
"severity": "HIGH"
},
"details": "The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.",
"id": "GHSA-hxjp-q6c3-38fx",
"modified": "2024-10-14T14:14:56Z",
"published": "2023-02-10T09:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22832"
},
{
"type": "WEB",
"url": "https://github.com/apache/nifi/commit/e966336e8966cf0cbbd12a2c4f2d73a7ceb75cd8"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/nifi"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/b51qs6y7b7r58vovddkv6wc16g2xbl3w"
},
{
"type": "WEB",
"url": "https://nifi.apache.org/security.html#CVE-2023-22832"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "XML External Entity Reference in Apache NiFi"
}
GHSA-HXV5-FPM3-VHQH
Vulnerability from github – Published: 2025-05-07 15:31 – Updated: 2025-05-07 15:31SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.
{
"affected": [],
"aliases": [
"CVE-2025-2777"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-07T15:15:57Z",
"severity": "CRITICAL"
},
"details": "SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.",
"id": "GHSA-hxv5-fpm3-vhqh",
"modified": "2025-05-07T15:31:42Z",
"published": "2025-05-07T15:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2777"
},
{
"type": "WEB",
"url": "https://documentation.sysaid.com/docs/24-40-60"
},
{
"type": "WEB",
"url": "https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-HXXP-6546-WV6R
Vulnerability from github – Published: 2021-07-02 18:36 – Updated: 2023-10-27 15:58Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers with the ability to control the report files parsed using this plugin to have Jenkins parse a crafted report file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Jenkins Selenium HTML report Plugin 1.1 disables external entity resolution for its XML parser.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.0"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:seleniumhtmlreport"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21672"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2021-07-01T20:14:49Z",
"nvd_published_at": "2021-06-30T17:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers with the ability to control the report files parsed using this plugin to have Jenkins parse a crafted report file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.\n\nJenkins Selenium HTML report Plugin 1.1 disables external entity resolution for its XML parser.",
"id": "GHSA-hxxp-6546-wv6r",
"modified": "2023-10-27T15:58:03Z",
"published": "2021-07-02T18:36:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21672"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/seleniumhtmlreport-plugin/commit/5ca59b8c7d23af4450dc7f19c1b4107d59063ae1"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/seleniumhtmlreport-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2329"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/06/30/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/04/14/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in Jenkins Selenium HTML report Plugin"
}
GHSA-J22Q-32G5-7C29
Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2022-05-13 01:25www.modified-shop.org modified eCommerce Shopsoftware 2.0.2.2 rev 10690 has XXE in api/it-recht-kanzlei/api-it-recht-kanzlei.php.
{
"affected": [],
"aliases": [
"CVE-2017-8110"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-25T17:59:00Z",
"severity": "CRITICAL"
},
"details": "www.modified-shop.org modified eCommerce Shopsoftware 2.0.2.2 rev 10690 has XXE in api/it-recht-kanzlei/api-it-recht-kanzlei.php.",
"id": "GHSA-j22q-32g5-7c29",
"modified": "2022-05-13T01:25:26Z",
"published": "2022-05-13T01:25:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8110"
},
{
"type": "WEB",
"url": "http://jgj212.blogspot.hk/2017/04/modified-ecommerce-shopsoftware-2022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J23M-3CCJ-PXXW
Vulnerability from github – Published: 2025-12-24 21:30 – Updated: 2025-12-24 21:30KYOCERA Net Admin 3.4.0906 contains an XML External Entity (XXE) injection vulnerability in the Multi-Set Template Editor that allows unauthenticated attackers to read arbitrary system files. Attackers can craft a malicious XML file with external entity references to retrieve sensitive configuration data like database credentials through an out-of-band channel attack.
{
"affected": [],
"aliases": [
"CVE-2019-25253"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-24T20:15:53Z",
"severity": "HIGH"
},
"details": "KYOCERA Net Admin 3.4.0906 contains an XML External Entity (XXE) injection vulnerability in the Multi-Set Template Editor that allows unauthenticated attackers to read arbitrary system files. Attackers can craft a malicious XML file with external entity references to retrieve sensitive configuration data like database credentials through an out-of-band channel attack.",
"id": "GHSA-j23m-3ccj-pxxw",
"modified": "2025-12-24T21:30:34Z",
"published": "2025-12-24T21:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25253"
},
{
"type": "WEB",
"url": "https://global.kyocera.com"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44430"
},
{
"type": "WEB",
"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5459.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J28W-MFMP-M73W
Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32XML External Entity (XXE) vulnerability in Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), versions 16.10, 16.20, 17.10. This vulnerability could be exploited to allow a XML External Entity (XXE) injection.
{
"affected": [],
"aliases": [
"CVE-2018-6486"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-02T14:29:00Z",
"severity": "CRITICAL"
},
"details": "XML External Entity (XXE) vulnerability in Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), versions 16.10, 16.20, 17.10. This vulnerability could be exploited to allow a XML External Entity (XXE) injection.",
"id": "GHSA-j28w-mfmp-m73w",
"modified": "2022-05-13T01:32:01Z",
"published": "2022-05-13T01:32:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6486"
},
{
"type": "WEB",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03083653"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102902"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J2C4-RR9Q-8J5C
Vulnerability from github – Published: 2022-05-24 16:45 – Updated: 2024-04-04 00:32BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.
{
"affected": [],
"aliases": [
"CVE-2018-14485"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-05-07T18:29:00Z",
"severity": "CRITICAL"
},
"details": "BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.",
"id": "GHSA-j2c4-rr9q-8j5c",
"modified": "2024-04-04T00:32:00Z",
"published": "2022-05-24T16:45:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14485"
},
{
"type": "WEB",
"url": "https://github.com/rxtur/BlogEngine.NET/commits/master"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/46106"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/151063/BlogEngine-3.3-XML-External-Entity-Injection.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J2WX-Q7QW-R37W
Vulnerability from github – Published: 2023-09-05 00:30 – Updated: 2024-04-04 07:26IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 258786.
{
"affected": [],
"aliases": [
"CVE-2023-35892"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-05T00:15:07Z",
"severity": "CRITICAL"
},
"details": "IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 258786.",
"id": "GHSA-j2wx-q7qw-r37w",
"modified": "2024-04-04T07:26:22Z",
"published": "2023-09-05T00:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35892"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/258786"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7030359"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.