Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1697 vulnerabilities reference this CWE, most recent first.
GHSA-P8MG-76FJ-RC53
Vulnerability from github – Published: 2023-02-03 00:30 – Updated: 2023-02-09 03:30
VLAI
Details
IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226328.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2022-22486"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-03T00:15:00Z",
"severity": "CRITICAL"
},
"details": "IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226328.",
"id": "GHSA-p8mg-76fj-rc53",
"modified": "2023-02-09T03:30:18Z",
"published": "2023-02-03T00:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22486"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/226328"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6890697"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P99P-726H-C8V5
Vulnerability from github – Published: 2018-10-19 16:42 – Updated: 2022-09-14 19:12
VLAI
Summary
Apache juddi-client vulnerable to XML External Entity (XXE)
Details
In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD type of attacks. Mitigation is to use 3.3.5.
Severity
8.1 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.juddi:juddi-client"
},
"ranges": [
{
"events": [
{
"introduced": "3.2"
},
{
"fixed": "3.3.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1307"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:48:42Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD type of attacks. Mitigation is to use 3.3.5.",
"id": "GHSA-p99p-726h-c8v5",
"modified": "2022-09-14T19:12:48Z",
"published": "2018-10-19T16:42:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1307"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-p99p-726h-c8v5"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/JUDDI-987"
},
{
"type": "WEB",
"url": "http://juddi.apache.org/security.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Apache juddi-client vulnerable to XML External Entity (XXE)"
}
GHSA-P9J3-8MPG-P3PF
Vulnerability from github – Published: 2022-04-01 00:00 – Updated: 2022-04-07 00:00
VLAI
Details
The "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a malicious XML configuration file.
Severity
7.2 (High)
{
"affected": [],
"aliases": [
"CVE-2021-33208"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-30T22:15:00Z",
"severity": "HIGH"
},
"details": "The \"Register an Ehcache Configuration File\" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a malicious XML configuration file.",
"id": "GHSA-p9j3-8mpg-p3pf",
"modified": "2022-04-07T00:00:29Z",
"published": "2022-04-01T00:00:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33208"
},
{
"type": "WEB",
"url": "https://github.com/blackarrowsec/advisories/tree/master/2021/CVE-2021-33208"
},
{
"type": "WEB",
"url": "https://www.softwareag.com/corporate/products/az/mashzone_nextgen/default"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P9WF-3XPG-C9G5
Vulnerability from github – Published: 2021-09-02 17:11 – Updated: 2024-10-24 21:53
VLAI
Summary
XML External Entity Injection in PyWPS
Details
An XML external entity (XXE) injection in PyWPS before 4.5.0 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pywps"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-39371"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-91"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-25T19:48:42Z",
"nvd_published_at": "2021-08-23T01:15:00Z",
"severity": "HIGH"
},
"details": "An XML external entity (XXE) injection in PyWPS before 4.5.0 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.",
"id": "GHSA-p9wf-3xpg-c9g5",
"modified": "2024-10-24T21:53:22Z",
"published": "2021-09-02T17:11:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39371"
},
{
"type": "WEB",
"url": "https://github.com/geopython/OWSLib/issues/790"
},
{
"type": "WEB",
"url": "https://github.com/geopython/pywps/pull/616"
},
{
"type": "WEB",
"url": "https://github.com/geopython/pywps/commit/7d6b26a2e931df2feca0b7fb24f4d01610825aee"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-p9wf-3xpg-c9g5"
},
{
"type": "PACKAGE",
"url": "https://github.com/geopython/pywps"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pywps/PYSEC-2021-121.yaml"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00001.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "XML External Entity Injection in PyWPS"
}
GHSA-PC2G-2G3X-J4C9
Vulnerability from github – Published: 2022-03-24 00:00 – Updated: 2022-03-30 00:01
VLAI
Details
A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data.
Severity
{
"affected": [],
"aliases": [
"CVE-2022-0861"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-23T15:15:00Z",
"severity": "MODERATE"
},
"details": "A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data.",
"id": "GHSA-pc2g-2g3x-j4c9",
"modified": "2022-03-30T00:01:10Z",
"published": "2022-03-24T00:00:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0861"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10379"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PC2G-MV23-62MR
Vulnerability from github – Published: 2022-05-13 01:14 – Updated: 2022-05-13 01:14
VLAI
Details
IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 128612.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2017-1477"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-13T23:29:00Z",
"severity": "HIGH"
},
"details": "IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 128612.",
"id": "GHSA-pc2g-mv23-62mr",
"modified": "2022-05-13T01:14:05Z",
"published": "2022-05-13T01:14:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1477"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/128612"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg22009240"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PC48-9J3J-4V3W
Vulnerability from github – Published: 2023-02-21 09:30 – Updated: 2023-03-02 18:30
VLAI
Details
php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities was silently enabled via \LIBXML_DTDLOAD | \LIBXML_DTDATTR.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-26267"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-21T09:15:00Z",
"severity": "MODERATE"
},
"details": "php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities was silently enabled via \\LIBXML_DTDLOAD | \\LIBXML_DTDATTR.",
"id": "GHSA-pc48-9j3j-4v3w",
"modified": "2023-03-02T18:30:31Z",
"published": "2023-02-21T09:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26267"
},
{
"type": "WEB",
"url": "https://git.sr.ht/~fkooman/php-saml-sp/commit/851f75b298a77e62d9022f1b170f662f5f7716d6"
},
{
"type": "WEB",
"url": "https://git.sr.ht/~fkooman/php-saml-sp/log"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PC54-PCHM-XCW6
Vulnerability from github – Published: 2022-05-17 04:13 – Updated: 2022-06-17 01:12
VLAI
Summary
XML External Entity Reference in RESTEasy
Details
DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.0.10.Final"
},
"package": {
"ecosystem": "Maven",
"name": "org.jboss.resteasy:resteasy-jaxrs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.11.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-7839"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-17T01:12:47Z",
"nvd_published_at": "2014-11-25T15:59:00Z",
"severity": "MODERATE"
},
"details": "DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.",
"id": "GHSA-pc54-pchm-xcw6",
"modified": "2022-06-17T01:12:47Z",
"published": "2022-05-17T04:13:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7839"
},
{
"type": "WEB",
"url": "https://github.com/resteasy/resteasy/pull/611/commits/3ab999c899c455a0b0a00bf5e455ed3e8d9ae347"
},
{
"type": "WEB",
"url": "https://github.com/resteasy/resteasy/pull/611/commits/8b5d8cfc963794a74636d9a840e899408ec8fdc6"
},
{
"type": "PACKAGE",
"url": "https://github.com/resteasy/Resteasy"
},
{
"type": "WEB",
"url": "https://issues.jboss.org/browse/RESTEASY-1130"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0773.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0850.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0851.html"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "XML External Entity Reference in RESTEasy"
}
GHSA-PC6W-59FV-RH23
Vulnerability from github – Published: 2025-09-04 12:30 – Updated: 2025-09-05 15:28
VLAI
Summary
Langchain Community Vulnerable to XML External Entity (XXE) Attacks
Details
The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd. This issue has been fixed in 0.3.27 of langchain-community.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "langchain-community"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.27"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-6984"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-05T15:28:25Z",
"nvd_published_at": "2025-09-04T10:42:33Z",
"severity": "HIGH"
},
"details": "The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd. This issue has been fixed in 0.3.27 of langchain-community.",
"id": "GHSA-pc6w-59fv-rh23",
"modified": "2025-09-05T15:28:25Z",
"published": "2025-09-04T12:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6984"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain-community/commit/e842452108089524e22c3a2ced851c021884556f"
},
{
"type": "PACKAGE",
"url": "https://github.com/langchain-ai/langchain-community"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain/blob/d79b5813a0b3b243c612b77013768995e46c4337/libs/langchain/langchain/document_loaders/evernote.py#L1-L23"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/a6b521cf-258c-41c0-9edb-d8ef976abb2a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Langchain Community Vulnerable to XML External Entity (XXE) Attacks"
}
GHSA-PCC2-W6M8-X5W4
Vulnerability from github – Published: 2023-01-26 21:30 – Updated: 2023-02-06 16:42
VLAI
Summary
Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin
Details
Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:semantic-versioning-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-24429"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-27T01:00:32Z",
"nvd_published_at": "2023-01-26T21:18:00Z",
"severity": "CRITICAL"
},
"details": "Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.",
"id": "GHSA-pcc2-w6m8-x5w4",
"modified": "2023-02-06T16:42:09Z",
"published": "2023-01-26T21:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24429"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/semantic-versioning-plugin/commit/c67a89822f86a7d10498ea2783b833052b719086"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/semantic-versioning-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2973%20(1)"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin "
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.