Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1697 vulnerabilities reference this CWE, most recent first.
GHSA-QV32-7R6P-XHHH
Vulnerability from github – Published: 2018-10-19 16:39 – Updated: 2021-09-16 21:06
VLAI
Summary
Moderate severity vulnerability that affects com.adobe.xmp:xmpcore
Details
XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.adobe.xmp:xmpcore"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-4216"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:52:48Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"id": "GHSA-qv32-7r6p-xhhh",
"modified": "2021-09-16T21:06:35Z",
"published": "2018-10-19T16:39:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4216"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-qv32-7r6p-xhhh"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/xmpcore/apsb16-24.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/91717"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Moderate severity vulnerability that affects com.adobe.xmp:xmpcore"
}
GHSA-QVV4-58RX-F26C
Vulnerability from github – Published: 2022-05-24 16:59 – Updated: 2024-04-04 02:31
VLAI
Details
XML external entity (XXE) vulnerability in Episerver 7 patch 4 and earlier allows remote attackers to read arbitrary files via a crafted DTD in an XML request involving util/xmlrpc/Handler.ashx.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2017-17762"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-29T19:29:00Z",
"severity": "HIGH"
},
"details": "XML external entity (XXE) vulnerability in Episerver 7 patch 4 and earlier allows remote attackers to read arbitrary files via a crafted DTD in an XML request involving util/xmlrpc/Handler.ashx.",
"id": "GHSA-qvv4-58rx-f26c",
"modified": "2024-04-04T02:31:42Z",
"published": "2022-05-24T16:59:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17762"
},
{
"type": "WEB",
"url": "https://gist.github.com/jonaslejon/5f92779848360a1a1e676af0795bd9aa"
},
{
"type": "WEB",
"url": "https://kryptera.se/sarbarhet-i-episerver"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QVWF-W35M-6R95
Vulnerability from github – Published: 2022-05-14 03:49 – Updated: 2023-07-06 22:05
VLAI
Summary
XXE Vulnerability in XMLBundle 0.1.7
Details
XMLBundle version 0.1.7 is vulnerable to XXE attacks which can result in denial of service attacks.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "desperado/xml-bundle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.1.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-1000477"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-06T22:05:33Z",
"nvd_published_at": "2018-01-03T18:29:00Z",
"severity": "HIGH"
},
"details": "XMLBundle version 0.1.7 is vulnerable to XXE attacks which can result in denial of service attacks.",
"id": "GHSA-qvwf-w35m-6r95",
"modified": "2023-07-06T22:05:33Z",
"published": "2022-05-14T03:49:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000477"
},
{
"type": "WEB",
"url": "https://github.com/pravednik/xmlBundle/issues/2"
},
{
"type": "WEB",
"url": "https://github.com/pravednik/xmlBundle/pull/5/commits/803d8cb34b972e67c2144b8b36575f97d14ef1d6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "XXE Vulnerability in XMLBundle 0.1.7"
}
GHSA-QW37-CXPJ-W543
Vulnerability from github – Published: 2025-04-04 18:30 – Updated: 2026-04-01 18:34
VLAI
Details
Improper Restriction of XML External Entity Reference vulnerability in supsystic Easy Google Maps allows XML Injection. This issue affects Easy Google Maps: from n/a through 1.11.17.
Severity
6.6 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-32138"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-04T16:15:22Z",
"severity": "MODERATE"
},
"details": "Improper Restriction of XML External Entity Reference vulnerability in supsystic Easy Google Maps allows XML Injection. This issue affects Easy Google Maps: from n/a through 1.11.17.",
"id": "GHSA-qw37-cxpj-w543",
"modified": "2026-04-01T18:34:29Z",
"published": "2025-04-04T18:30:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32138"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/google-maps-easy/vulnerability/wordpress-easy-google-maps-plugin-1-11-17-xml-external-entity-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-QWGX-59JW-QFG9
Vulnerability from github – Published: 2022-05-13 01:14 – Updated: 2022-07-01 11:55
VLAI
Summary
Improper Restriction of XML External Entity Reference in Apache Batik
Details
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
Severity
7.3 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.xmlgraphics:batik"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-5662"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-01T11:55:03Z",
"nvd_published_at": "2017-04-18T14:59:00Z",
"severity": "HIGH"
},
"details": "In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.",
"id": "GHSA-qwgx-59jw-qfg9",
"modified": "2022-07-01T11:55:03Z",
"published": "2022-05-13T01:14:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5662"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2546"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2547"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4215"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"type": "WEB",
"url": "https://xmlgraphics.apache.org/security.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97948"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038334"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference in Apache Batik"
}
GHSA-QWWW-R8V3-26CG
Vulnerability from github – Published: 2024-11-04 21:30 – Updated: 2024-11-04 21:30
VLAI
Details
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-45086"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-04T20:15:05Z",
"severity": "MODERATE"
},
"details": "IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.",
"id": "GHSA-qwww-r8v3-26cg",
"modified": "2024-11-04T21:30:32Z",
"published": "2024-11-04T21:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45086"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7174745"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-QXHF-XWCG-8FXP
Vulnerability from github – Published: 2022-05-24 16:43 – Updated: 2024-04-04 00:01
VLAI
Details
An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access to files on any system reachable by the UEM service account.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2019-8999"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-04-18T17:29:00Z",
"severity": "HIGH"
},
"details": "An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access to files on any system reachable by the UEM service account.",
"id": "GHSA-qxhf-xwcg-8fxp",
"modified": "2024-04-04T00:01:34Z",
"published": "2022-05-24T16:43:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8999"
},
{
"type": "WEB",
"url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000056241"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R268-64HQ-MV45
Vulnerability from github – Published: 2024-09-12 03:31 – Updated: 2024-09-12 03:31
VLAI
Details
An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.
Severity
8.2 (High)
{
"affected": [],
"aliases": [
"CVE-2024-37397"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-12T02:15:03Z",
"severity": "HIGH"
},
"details": "An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.",
"id": "GHSA-r268-64hq-mv45",
"modified": "2024-09-12T03:31:26Z",
"published": "2024-09-12T03:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37397"
},
{
"type": "WEB",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R2MJ-8WGQ-73M6
Vulnerability from github – Published: 2021-08-09 20:43 – Updated: 2024-09-20 20:59
VLAI
Summary
XML External Entity Reference in Glances
Details
The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
Severity
6.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Glances"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23418"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-02T18:18:37Z",
"nvd_published_at": "2021-07-29T18:15:00Z",
"severity": "MODERATE"
},
"details": "The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.\n",
"id": "GHSA-r2mj-8wgq-73m6",
"modified": "2024-09-20T20:59:24Z",
"published": "2021-08-09T20:43:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23418"
},
{
"type": "WEB",
"url": "https://github.com/nicolargo/glances/issues/1025"
},
{
"type": "WEB",
"url": "https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94"
},
{
"type": "WEB",
"url": "https://github.com/nicolargo/glances/commit/85d5a6b4af31fcf785d5a61086cbbd166b40b07a"
},
{
"type": "WEB",
"url": "https://github.com/nicolargo/glances/commit/9d6051be4a42f692392049fdbfc85d5dfa458b32"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-r2mj-8wgq-73m6"
},
{
"type": "PACKAGE",
"url": "https://github.com/nicolargo/glances"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/glances/PYSEC-2021-115.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-GLANCES-1311807"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "XML External Entity Reference in Glances"
}
GHSA-R2PP-X4MM-4999
Vulnerability from github – Published: 2018-12-20 22:02 – Updated: 2022-09-14 22:20
VLAI
Summary
XML External Entity (XXE) vulnerability in neo4j.procedure:apoc
Details
neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit 45bc09c.
Severity
10.0 (Critical)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.4.0.3"
},
"package": {
"ecosystem": "Maven",
"name": "org.neo4j.procedure:apoc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.0.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1000820"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:53:21Z",
"nvd_published_at": "2018-12-20T15:29:00Z",
"severity": "CRITICAL"
},
"details": "neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit 45bc09c.",
"id": "GHSA-r2pp-x4mm-4999",
"modified": "2022-09-14T22:20:27Z",
"published": "2018-12-20T22:02:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000820"
},
{
"type": "WEB",
"url": "https://github.com/neo4j-contrib/neo4j-apoc-procedures/issues/931"
},
{
"type": "WEB",
"url": "https://0dd.zone/2018/10/27/neo4f-apoc-procedures-XXE"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XML External Entity (XXE) vulnerability in neo4j.procedure:apoc"
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.