Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1697 vulnerabilities reference this CWE, most recent first.
GHSA-V2PP-7V4J-XG4G
Vulnerability from github – Published: 2023-10-27 21:30 – Updated: 2023-11-08 03:30
VLAI
Details
An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-34832"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-27T21:15:08Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component.",
"id": "GHSA-v2pp-7v4j-xg4g",
"modified": "2023-11-08T03:30:31Z",
"published": "2023-10-27T21:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34832"
},
{
"type": "WEB",
"url": "https://crashpark.weebly.com/blog/xxe-in-agilereporter-213-by-vermeg"
},
{
"type": "WEB",
"url": "https://www.vermeg.com/agile-reporter"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V2XM-76PQ-PHCF
Vulnerability from github – Published: 2024-06-21 06:31 – Updated: 2024-06-21 15:06
VLAI
Summary
ClassGraph XML External Entity Reference
Details
ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.github.classgraph:classgraph"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.8.112"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-47621"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-21T15:06:26Z",
"nvd_published_at": "2024-06-21T06:15:10Z",
"severity": "MODERATE"
},
"details": "ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.",
"id": "GHSA-v2xm-76pq-phcf",
"modified": "2024-06-21T15:06:26Z",
"published": "2024-06-21T06:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47621"
},
{
"type": "WEB",
"url": "https://github.com/classgraph/classgraph/pull/539"
},
{
"type": "WEB",
"url": "https://github.com/classgraph/classgraph/commit/681362ad6b0b9d9abaffb2e07099ce54d7a41fa3"
},
{
"type": "WEB",
"url": "https://docs.r3.com/en/platform/corda/4.8/enterprise/release-notes-enterprise.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/classgraph/classgraph"
},
{
"type": "WEB",
"url": "https://github.com/classgraph/classgraph/releases/tag/classgraph-4.8.112"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "ClassGraph XML External Entity Reference"
}
GHSA-V2XR-WHR4-9P35
Vulnerability from github – Published: 2025-07-21 18:32 – Updated: 2025-07-21 18:32
VLAI
Details
Dell AppSync, version(s) 4.6.0.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering.
Severity
4.2 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-36603"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-21T17:15:36Z",
"severity": "MODERATE"
},
"details": "Dell AppSync, version(s) 4.6.0.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering.",
"id": "GHSA-v2xr-whr4-9p35",
"modified": "2025-07-21T18:32:18Z",
"published": "2025-07-21T18:32:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36603"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000345331/dsa-2025-277-security-update-for-dell-appsync-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-V3PX-6VF7-C58J
Vulnerability from github – Published: 2022-05-24 17:49 – Updated: 2022-05-24 17:49
VLAI
Details
A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
{
"affected": [],
"aliases": [
"CVE-2021-25163"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-29T11:15:00Z",
"severity": "HIGH"
},
"details": "A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.",
"id": "GHSA-v3px-6vf7-c58j",
"modified": "2022-05-24T17:49:05Z",
"published": "2022-05-24T17:49:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25163"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-010.txt"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-V3XC-F323-99X9
Vulnerability from github – Published: 2022-05-17 02:28 – Updated: 2022-05-17 02:28
VLAI
Details
IBM Security Guardium 10.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 124634.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2017-1254"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-05T18:29:00Z",
"severity": "HIGH"
},
"details": "IBM Security Guardium 10.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 124634.",
"id": "GHSA-v3xc-f323-99x9",
"modified": "2022-05-17T02:28:13Z",
"published": "2022-05-17T02:28:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1254"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/124634"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg22004463"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99366"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-V4RR-65X6-G69F
Vulnerability from github – Published: 2022-03-30 00:00 – Updated: 2022-05-03 20:56
VLAI
Summary
XXE vulnerability in Jenkins Flaky Test Handler Plugin
Details
Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Severity
8.1 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:flaky-test-handler"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-28140"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-05-03T20:56:05Z",
"nvd_published_at": "2022-03-29T13:15:00Z",
"severity": "HIGH"
},
"details": "Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.",
"id": "GHSA-v4rr-65x6-g69f",
"modified": "2022-05-03T20:56:05Z",
"published": "2022-03-30T00:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28140"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/flaky-test-handler-plugin/commit/c4ab38fef3658a02315a00288b934bdd9981b3a4"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/flaky-test-handler-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-1896"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/03/29/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in Jenkins Flaky Test Handler Plugin"
}
GHSA-V4WV-V525-P5GQ
Vulnerability from github – Published: 2022-12-29 09:30 – Updated: 2023-01-06 18:30
VLAI
Details
A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigurations of the file src/main/java/org/sitenv/vocabularies/configuration/CodeValidatorApiConfiguration.java of the component XML Handler. The manipulation leads to xml external entity reference. Upgrading to version 1.0.31 is able to address this issue. The name of the patch is fbd8ea121755a2d3d116b13f235bc8b61d8449af. It is recommended to upgrade the affected component. VDB-217018 is the identifier assigned to this vulnerability.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2021-4295"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-29T09:15:00Z",
"severity": "CRITICAL"
},
"details": "A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigurations of the file src/main/java/org/sitenv/vocabularies/configuration/CodeValidatorApiConfiguration.java of the component XML Handler. The manipulation leads to xml external entity reference. Upgrading to version 1.0.31 is able to address this issue. The name of the patch is fbd8ea121755a2d3d116b13f235bc8b61d8449af. It is recommended to upgrade the affected component. VDB-217018 is the identifier assigned to this vulnerability.",
"id": "GHSA-v4wv-v525-p5gq",
"modified": "2023-01-06T18:30:20Z",
"published": "2022-12-29T09:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4295"
},
{
"type": "WEB",
"url": "https://github.com/onc-healthit/code-validator-api/pull/97"
},
{
"type": "WEB",
"url": "https://github.com/onc-healthit/code-validator-api/commit/fbd8ea121755a2d3d116b13f235bc8b61d8449af"
},
{
"type": "WEB",
"url": "https://github.com/onc-healthit/code-validator-api/releases/tag/1.0.31"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.217018"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.217018"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V5CV-FP89-8WPM
Vulnerability from github – Published: 2022-05-24 16:48 – Updated: 2024-04-04 01:02
VLAI
Details
BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2019-10718"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-21T19:15:00Z",
"severity": "HIGH"
},
"details": "BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs.",
"id": "GHSA-v5cv-fp89-8wpm",
"modified": "2024-04-04T01:02:32Z",
"published": "2022-05-24T16:48:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10718"
},
{
"type": "WEB",
"url": "https://www.securitymetrics.com/blog/blogenginenet-xml-external-entity-attacks"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/153364/BlogEngine.NET-3.3.6-3.3.7-XML-Injection.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V62G-JWJ9-RFVX
Vulnerability from github – Published: 2024-07-24 09:30 – Updated: 2024-09-10 18:50
VLAI
Summary
XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill
Details
XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.drill.exec:drill-java-exec"
},
"ranges": [
{
"events": [
{
"introduced": "1.19.0"
},
{
"fixed": "1.21.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-48362"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-24T16:02:33Z",
"nvd_published_at": "2024-07-24T08:15:02Z",
"severity": "HIGH"
},
"details": "XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue.",
"id": "GHSA-v62g-jwj9-rfvx",
"modified": "2024-09-10T18:50:27Z",
"published": "2024-07-24T09:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48362"
},
{
"type": "WEB",
"url": "https://github.com/apache/drill/commit/0e88b7a5101d24c561a2a3efb12d7a3b3f7933f3"
},
{
"type": "WEB",
"url": "https://github.com/apache/drill"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/DRILL-8461"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/9tt0q4bdjwgw0dz0l9knqxjnpb5y6zsl"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/07/24/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill"
}
GHSA-V65R-3M4G-37FX
Vulnerability from github – Published: 2022-05-24 17:01 – Updated: 2024-04-04 02:39
VLAI
Details
An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2018-20687"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-11-18T19:15:00Z",
"severity": "CRITICAL"
},
"details": "An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.",
"id": "GHSA-v65r-3m4g-37fx",
"modified": "2024-04-04T02:39:56Z",
"published": "2022-05-24T17:01:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20687"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/155359/Raritan-CommandCenter-Secure-Gateway-XML-Injection.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2019/Nov/11"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.