Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1697 vulnerabilities reference this CWE, most recent first.
GHSA-MHQM-WG7C-PGWH
Vulnerability from github – Published: 2022-05-14 01:40 – Updated: 2022-05-14 01:40
VLAI
Details
An issue was discovered in weixin-java-tools v3.2.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2018-20318"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-21T00:29:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in weixin-java-tools v3.2.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file.",
"id": "GHSA-mhqm-wg7c-pgwh",
"modified": "2022-05-14T01:40:23Z",
"published": "2022-05-14T01:40:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20318"
},
{
"type": "WEB",
"url": "https://github.com/Wechat-Group/weixin-java-tools/issues/889"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-MHXG-PCMJ-CHVJ
Vulnerability from github – Published: 2022-05-17 00:36 – Updated: 2022-05-17 00:36
VLAI
Details
IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 130156.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2017-1527"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-26T17:29:00Z",
"severity": "HIGH"
},
"details": "IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 130156.",
"id": "GHSA-mhxg-pcmj-chvj",
"modified": "2022-05-17T00:36:07Z",
"published": "2022-05-17T00:36:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1527"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/130156"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg22007346"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100959"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-MJ5V-GGJC-48P5
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2023-10-27 16:04
VLAI
Summary
XXE vulnerability in Jenkins OWASP Dependency-Check Plugin
Details
Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers able to control workspace contents to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Severity
7.1 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.1.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:dependency-check-jenkins-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-43577"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-15T16:41:14Z",
"nvd_published_at": "2021-11-12T11:15:00Z",
"severity": "HIGH"
},
"details": "Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers able to control workspace contents to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.",
"id": "GHSA-mj5v-ggjc-48p5",
"modified": "2023-10-27T16:04:50Z",
"published": "2022-05-24T19:20:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43577"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/dependency-check-plugin/commit/c10d1496f9f0301e276daecea88161a905fca6d4"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/dependency-check-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2488"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/11/12/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in Jenkins OWASP Dependency-Check Plugin"
}
GHSA-MJF9-XJP8-6CR8
Vulnerability from github – Published: 2026-01-06 18:31 – Updated: 2026-01-06 18:31
VLAI
Details
Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access to data and resources outside of the intended sphere of control.
Severity
7.6 (High)
{
"affected": [],
"aliases": [
"CVE-2025-36589"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-06T17:15:43Z",
"severity": "HIGH"
},
"details": "Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access to data and resources outside of the intended sphere of control.",
"id": "GHSA-mjf9-xjp8-6cr8",
"modified": "2026-01-06T18:31:35Z",
"published": "2026-01-06T18:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36589"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000402262/dsa-2025-425-dell-powermaxos-dell-powermax-eem-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance-dell-unisphere-360-dell-solutions-enabler-virtual-appliance-security-update-for-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-MJM5-8P7X-R4CV
Vulnerability from github – Published: 2023-11-08 18:30 – Updated: 2023-11-08 18:30
VLAI
Details
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-5136"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-732"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-08T16:15:11Z",
"severity": "MODERATE"
},
"details": "An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.\n",
"id": "GHSA-mjm5-8p7x-r4cv",
"modified": "2023-11-08T18:30:31Z",
"published": "2023-11-08T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5136"
},
{
"type": "WEB",
"url": "https://www.ni.com/en/support/documentation/supplemental/23/incorrect-permission-assignment-in-the-topografix-dataplug-for-gpx.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MM8J-9X84-M9CV
Vulnerability from github – Published: 2021-06-16 17:34 – Updated: 2021-04-06 21:44
VLAI
Summary
Arbitrary code injection in json-sanitizer
Details
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.mikesamuel:json-sanitizer"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23899"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-06T21:44:01Z",
"nvd_published_at": "2021-01-13T16:15:00Z",
"severity": "CRITICAL"
},
"details": "OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.",
"id": "GHSA-mm8j-9x84-m9cv",
"modified": "2021-04-06T21:44:01Z",
"published": "2021-06-16T17:34:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23899"
},
{
"type": "WEB",
"url": "https://github.com/OWASP/json-sanitizer/commit/a37f594f7378a1c76b3283e0dab9e1ab1dc0247e"
},
{
"type": "WEB",
"url": "https://github.com/OWASP/json-sanitizer/compare/v1.2.1...v1.2.2"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/json-sanitizer-support/c/dAW1AeNMoA0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Arbitrary code injection in json-sanitizer"
}
GHSA-MM8X-P4PR-4P9F
Vulnerability from github – Published: 2024-02-06 09:31 – Updated: 2024-02-14 00:35
VLAI
Details
The XML parser in Magic xpi Integration Platform 4.13.4 allows XXE attacks, e.g., via onItemImport.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-52239"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-06T07:15:10Z",
"severity": "MODERATE"
},
"details": "The XML parser in Magic xpi Integration Platform 4.13.4 allows XXE attacks, e.g., via onItemImport.",
"id": "GHSA-mm8x-p4pr-4p9f",
"modified": "2024-02-14T00:35:41Z",
"published": "2024-02-06T09:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52239"
},
{
"type": "WEB",
"url": "https://ds-security.com/post/xml_external_entity_injection_magic_xpi"
},
{
"type": "WEB",
"url": "https://www2.magicsoftware.com/ver/docs/Downloads/Magicxpi/4.14/Windows/ReleaseNotes4.14.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MMCG-C68Q-4P38
Vulnerability from github – Published: 2022-05-13 01:11 – Updated: 2022-05-13 01:11
VLAI
Details
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
{
"affected": [],
"aliases": [
"CVE-2013-1915"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-04-25T23:55:00Z",
"severity": "HIGH"
},
"details": "ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.",
"id": "GHSA-mmcg-c68q-4p38",
"modified": "2022-05-13T01:11:43Z",
"published": "2022-05-13T01:11:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1915"
},
{
"type": "WEB",
"url": "https://github.com/SpiderLabs/ModSecurity/commit/d4d80b38aa85eccb26e3c61b04d16e8ca5de76fe"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=947842"
},
{
"type": "WEB",
"url": "https://github.com/SpiderLabs/ModSecurity/blob/master/CHANGES"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101898.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101911.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102616.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/52847"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/52977"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2013/dsa-2659"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:156"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/04/03/7"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/58810"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-MMQW-R4V3-63Q7
Vulnerability from github – Published: 2025-09-26 21:30 – Updated: 2025-09-26 21:30
VLAI
Details
A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl&style=1. This manipulation causes xml external entity reference. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-11035"
],
"database_specific": {
"cwe_ids": [
"CWE-610",
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-26T19:15:34Z",
"severity": "MODERATE"
},
"details": "A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl\u0026style=1. This manipulation causes xml external entity reference. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.",
"id": "GHSA-mmqw-r4v3-63q7",
"modified": "2025-09-26T21:30:29Z",
"published": "2025-09-26T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11035"
},
{
"type": "WEB",
"url": "https://github.com/frwfxc123/CVE/issues/1"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.325982"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.325982"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.658253"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-MRVG-P24W-MP92
Vulnerability from github – Published: 2022-05-13 01:27 – Updated: 2025-04-12 12:47
VLAI
Details
The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.
{
"affected": [],
"aliases": [
"CVE-2015-3451"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-05-12T19:59:00Z",
"severity": "MODERATE"
},
"details": "The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.",
"id": "GHSA-mrvg-p24w-mp92",
"modified": "2025-04-12T12:47:43Z",
"published": "2022-05-13T01:27:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3451"
},
{
"type": "WEB",
"url": "https://bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94640b129ae8930a68a30/raw"
},
{
"type": "WEB",
"url": "http://advisories.mageia.org/MGASA-2015-0199.html"
},
{
"type": "WEB",
"url": "http://cpansearch.perl.org/src/SHLOMIF/XML-LibXML-2.0119/Changes"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157448.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157740.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-09/msg00006.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2015/dsa-3243"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:231"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/04/25/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/04/30/1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/74333"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2592-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.