CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1697 vulnerabilities reference this CWE, most recent first.
GHSA-QJ27-W92H-FC9R
Vulnerability from github – Published: 2022-05-24 17:06 – Updated: 2024-01-30 21:10XML external entity (XXE) vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"events": [
{
"introduced": "1.597"
},
{
"fixed": "1.600"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.596.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-1809"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:10:14Z",
"nvd_published_at": "2020-01-15T19:15:00Z",
"severity": "HIGH"
},
"details": "XML external entity (XXE) vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.",
"id": "GHSA-qj27-w92h-fc9r",
"modified": "2024-01-30T21:10:14Z",
"published": "2022-05-24T17:06:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1809"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205625"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2015-02-27"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "XML external entity (XXE) vulnerability in Jenkins"
}
GHSA-QJ7F-J6H9-G5RQ
Vulnerability from github – Published: 2022-05-17 00:26 – Updated: 2022-11-01 22:33An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.nifi:nifi"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-12623"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-01T22:33:57Z",
"nvd_published_at": "2017-10-10T18:29:00Z",
"severity": "MODERATE"
},
"details": "An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.",
"id": "GHSA-qj7f-j6h9-g5rq",
"modified": "2022-11-01T22:33:57Z",
"published": "2022-05-17T00:26:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12623"
},
{
"type": "WEB",
"url": "https://nifi.apache.org/security.html#CVE-2017-12623"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "XML External Entity Reference in Apache NiFi"
}
GHSA-QM84-429W-3353
Vulnerability from github – Published: 2022-05-14 01:22 – Updated: 2022-05-14 01:22Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2019-5918"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-12T22:29:00Z",
"severity": "CRITICAL"
},
"details": "Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.",
"id": "GHSA-qm84-429w-3353",
"modified": "2022-05-14T01:22:01Z",
"published": "2022-05-14T01:22:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5918"
},
{
"type": "WEB",
"url": "https://nablarch.atlassian.net/projects/NAB/issues/NAB-295"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN56542712/index.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QPJ9-QCWX-8JV2
Vulnerability from github – Published: 2025-06-19 14:29 – Updated: 2025-06-20 14:19Impact
What kind of vulnerability is it? Who is impacted?
In certain places, powsybl-core XML parsing is vulnerable to an XXE attack and in on place also to an SSRF attack.
This allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive files on the system.
The vulnerable class is com.powsybl.commons.xml.XmlReader which is considered to be untrusted in use cases where untrusted users can submit their XML to the vulnerable methods. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels.
Am I impacted?
You are vulnerable if you allow untrusted users to import untrusted CGMES or XIIDM network files.
Patches
com.powsybl:powsybl-commons:6.7.2 and higher
References
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.7.1"
},
"package": {
"ecosystem": "Maven",
"name": "com.powsybl:powsybl-commons"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.7.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-47293"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-19T14:29:40Z",
"nvd_published_at": "2025-06-19T22:15:19Z",
"severity": "LOW"
},
"details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\nIn certain places, powsybl-core XML parsing is vulnerable to an XXE attack and in on place also to an SSRF attack.\nThis allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive files on the system.\nThe vulnerable class is `com.powsybl.commons.xml.XmlReader` which is considered to be untrusted in use cases where untrusted users can submit their XML to the vulnerable methods. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels.\n\n#### Am I impacted?\nYou are vulnerable if you allow untrusted users to import untrusted CGMES or XIIDM network files.\n\n### Patches\ncom.powsybl:powsybl-commons:6.7.2 and higher\n\n### References\n[powsybl-core v6.7.2](https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2)",
"id": "GHSA-qpj9-qcwx-8jv2",
"modified": "2025-06-20T14:19:17Z",
"published": "2025-06-19T14:29:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/powsybl/powsybl-core/security/advisories/GHSA-qpj9-qcwx-8jv2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47293"
},
{
"type": "WEB",
"url": "https://github.com/powsybl/powsybl-core/commit/e6c7c4997ae8758b54a2f23ce1a499e25113acdc"
},
{
"type": "PACKAGE",
"url": "https://github.com/powsybl/powsybl-core"
},
{
"type": "WEB",
"url": "https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "PowSyBl Core XML Reader allows XXE and SSRF"
}
GHSA-QPMC-WPRV-X746
Vulnerability from github – Published: 2022-04-12 21:31 – Updated: 2022-04-12 21:31The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD.
{
"affected": [
{
"package": {
"ecosystem": "Hex",
"name": "sweet_xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-15160"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2022-04-12T21:31:26Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD.",
"id": "GHSA-qpmc-wprv-x746",
"modified": "2022-04-12T21:31:26Z",
"published": "2022-04-12T21:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15160"
},
{
"type": "WEB",
"url": "https://github.com/kbrw/sweet_xml/issues/71"
},
{
"type": "PACKAGE",
"url": "https://github.com/kbrw/sweet_xml"
},
{
"type": "WEB",
"url": "https://hex.pm/packages/sweet_xml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Inline DTD allows XML bomb attack"
}
GHSA-QQ48-V63V-876M
Vulnerability from github – Published: 2022-05-24 16:51 – Updated: 2023-02-03 21:30IBM i2 Intelligent Analyis Platform 9.0.0 through 9.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 157007.
{
"affected": [],
"aliases": [
"CVE-2019-4062"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-30T14:15:00Z",
"severity": "HIGH"
},
"details": "IBM i2 Intelligent Analyis Platform 9.0.0 through 9.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 157007.",
"id": "GHSA-qq48-v63v-876m",
"modified": "2023-02-03T21:30:35Z",
"published": "2022-05-24T16:51:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4062"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/157007"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10881746"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-QQC2-6QQ8-P574
Vulnerability from github – Published: 2022-02-25 00:00 – Updated: 2025-04-17 21:30A local, authenticated attacker could use an XML External Entity (XXE) attack to exploit weakly configured XML files to access local or remote content. A successful exploit could potentially cause a denial-of-service condition and allow the attacker to arbitrarily read any local file via system-level services.
{
"affected": [],
"aliases": [
"CVE-2020-14478"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-24T19:15:00Z",
"severity": "HIGH"
},
"details": "A local, authenticated attacker could use an XML External Entity (XXE) attack to exploit weakly configured XML files to access local or remote content. A successful exploit could potentially cause a denial-of-service condition and allow the attacker to arbitrarily read any local file via system-level services.",
"id": "GHSA-qqc2-6qq8-p574",
"modified": "2025-04-17T21:30:37Z",
"published": "2022-02-25T00:00:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14478"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-177-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QRFF-FQPR-45F9
Vulnerability from github – Published: 2021-12-09 00:01 – Updated: 2021-12-14 00:01National Library of the Netherlands digger < 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity (XXE) vulnerability. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS.
{
"affected": [],
"aliases": [
"CVE-2021-44556"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-08T12:15:00Z",
"severity": "CRITICAL"
},
"details": "National Library of the Netherlands digger \u003c 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity (XXE) vulnerability. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS.",
"id": "GHSA-qrff-fqpr-45f9",
"modified": "2021-12-14T00:01:40Z",
"published": "2021-12-09T00:01:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44556"
},
{
"type": "WEB",
"url": "https://github.com/KBNLresearch/digger/pull/1"
},
{
"type": "WEB",
"url": "https://github.com/KBNLresearch/digger"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-QRH7-X6FP-C2MP
Vulnerability from github – Published: 2022-05-17 05:09 – Updated: 2024-05-21 20:12The XML libraries for Python, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.0"
},
{
"fixed": "1.3.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.4.0"
},
{
"fixed": "1.4.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2013-1664"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-21T20:12:01Z",
"nvd_published_at": "2013-04-03T00:55:00Z",
"severity": "MODERATE"
},
"details": "The XML libraries for Python, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.",
"id": "GHSA-qrh7-x6fp-c2mp",
"modified": "2024-05-21T20:12:01Z",
"published": "2022-05-17T05:09:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1664"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/1c60d07ba23e0350351c278ad28d0bd5aa410b40"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/d19a27066b2247102e65412aa66917aff0091112"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/nova/+bug/1100282"
},
{
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html"
},
{
"type": "WEB",
"url": "http://bugs.python.org/issue17239"
},
{
"type": "WEB",
"url": "http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0657.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0658.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0670.html"
},
{
"type": "WEB",
"url": "http://ubuntu.com/usn/usn-1757-1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/02/19/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/02/19/4"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "XML Entity Expansion (XEE) in Django"
}
GHSA-QRP9-23P7-G5MF
Vulnerability from github – Published: 2024-02-27 18:31 – Updated: 2025-02-13 19:10XML External Entity injection in Apache Ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue.
More Details:
Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The vulnerability was caused through lack of proper user input validation.
This vulnerability is known as an XML External Entity (XXE) injection attack. Attackers can exploit XXE vulnerabilities to read arbitrary files on the server, including sensitive system files. In theory, it might be possible to use this to escalate privileges.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.ambari.contrib.views:wfmanager"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-50380"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-27T21:53:34Z",
"nvd_published_at": "2024-02-27T17:15:11Z",
"severity": "MODERATE"
},
"details": "XML External Entity injection in Apache Ambari versions \u003c= 2.7.7,\u00a0Users are recommended to upgrade to version 2.7.8, which fixes this issue.\n\nMore Details:\n\nOozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The vulnerability was caused through lack of proper user input validation.\n\nThis vulnerability is known as an XML External Entity (XXE) injection attack. Attackers can exploit XXE vulnerabilities to read arbitrary files on the server, including sensitive system files. In theory, it might be possible to use this to escalate privileges.",
"id": "GHSA-qrp9-23p7-g5mf",
"modified": "2025-02-13T19:10:30Z",
"published": "2024-02-27T18:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50380"
},
{
"type": "WEB",
"url": "https://github.com/apache/ambari/commit/d9652e4611ea36208d5f748028b3a9cd980e6edb"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/ambari"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/qrt7mq7v7zyrh1qsh1gkg1m7clysvy32"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/02/27/6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Ambari XML External Entity injection"
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.