CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1697 vulnerabilities reference this CWE, most recent first.
GHSA-VH3X-X68X-6R47
Vulnerability from github – Published: 2022-05-24 17:41 – Updated: 2022-05-24 17:41IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 194882.
{
"affected": [],
"aliases": [
"CVE-2021-20353"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-10T17:15:00Z",
"severity": "HIGH"
},
"details": "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 194882.",
"id": "GHSA-vh3x-x68x-6r47",
"modified": "2022-05-24T17:41:45Z",
"published": "2022-05-24T17:41:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20353"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/194882"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6413709"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-174"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VHFP-9WVJ-GWVG
Vulnerability from github – Published: 2021-11-01 19:19 – Updated: 2021-11-03 14:51A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "modx/revolution"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-25911"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2021-11-01T19:08:06Z",
"nvd_published_at": "2021-10-31T19:15:00Z",
"severity": "CRITICAL"
},
"details": "A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).",
"id": "GHSA-vhfp-9wvj-gwvg",
"modified": "2021-11-03T14:51:31Z",
"published": "2021-11-01T19:19:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25911"
},
{
"type": "WEB",
"url": "https://github.com/modxcms/revolution/issues/15237"
},
{
"type": "WEB",
"url": "https://github.com/modxcms/revolution/pull/15238"
},
{
"type": "WEB",
"url": "https://github.com/modxcms/revolution/pull/15238/commits/1b7ffe02df30f05dbf67dd15e4d8101687c1585a"
},
{
"type": "WEB",
"url": "https://github.com/dahua966/Vul_disclose/blob/main/XXE_modxcms.md"
},
{
"type": "PACKAGE",
"url": "https://github.com/modxcms/revolution"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "XML External Entity vulnerability in MODX CMS"
}
GHSA-VHHC-MR4W-PMW6
Vulnerability from github – Published: 2022-05-14 01:08 – Updated: 2022-05-14 01:08The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.
{
"affected": [],
"aliases": [
"CVE-2013-1824"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-09-16T13:02:00Z",
"severity": "MODERATE"
},
"details": "The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.",
"id": "GHSA-vhhc-mr4w-pmw6",
"modified": "2022-05-14T01:08:03Z",
"published": "2022-05-14T01:08:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1824"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=918187"
},
{
"type": "WEB",
"url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=188c196d4da60bdde9190d2fc532650d17f7af2d"
},
{
"type": "WEB",
"url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=afe98b7829d50806559acac9b530acb8283c3bf4"
},
{
"type": "WEB",
"url": "http://git.php.net/?p=php-src.git;a=commit;h=188c196d4da60bdde9190d2fc532650d17f7af2d"
},
{
"type": "WEB",
"url": "http://git.php.net/?p=php-src.git;a=commit;h=afe98b7829d50806559acac9b530acb8283c3bf4"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html"
},
{
"type": "WEB",
"url": "http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-1824.html"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT5880"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VHWV-8897-JM7Q
Vulnerability from github – Published: 2022-10-19 19:00 – Updated: 2022-12-16 19:56Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers able to control the input files for the 'Topaz for Total Test - Execute Total Test scenarios' build step to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.4.8"
},
"package": {
"ecosystem": "Maven",
"name": "com.compuware.jenkins:compuware-topaz-for-total-test"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-43430"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-10-19T21:22:06Z",
"nvd_published_at": "2022-10-19T16:15:00Z",
"severity": "HIGH"
},
"details": "Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers able to control the input files for the \u0027Topaz for Total Test - Execute Total Test scenarios\u0027 build step to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.",
"id": "GHSA-vhwv-8897-jm7q",
"modified": "2022-12-16T19:56:42Z",
"published": "2022-10-19T19:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43430"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/compuware-topaz-for-total-test-plugin/commit/9ce24fb63fcdb94290340d2ec53f478635c416ab"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/compuware-topaz-for-total-test-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2625"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/10/19/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in Jenkins Compuware Topaz for Total Test Plugin"
}
GHSA-VJ49-J7RC-H54F
Vulnerability from github – Published: 2023-08-25 21:30 – Updated: 2023-09-01 17:35An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size, causing CPU and memory consumption, such as a Java Out-of-Memory exception.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.esotericsoftware.yamlbeans:yamlbeans"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-24620"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-25T22:04:01Z",
"nvd_published_at": "2023-08-25T20:15:07Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size, causing CPU and memory consumption, such as a Java Out-of-Memory exception.",
"id": "GHSA-vj49-j7rc-h54f",
"modified": "2023-09-01T17:35:22Z",
"published": "2023-08-25T21:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24620"
},
{
"type": "WEB",
"url": "https://contrastsecurity.com"
},
{
"type": "WEB",
"url": "https://github.com/Contrast-Security-OSS/yamlbeans/blob/main/SECURITY.md"
},
{
"type": "WEB",
"url": "https://github.com/EsotericSoftware"
},
{
"type": "PACKAGE",
"url": "https://github.com/EsotericSoftware/yamlbeans"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Esoteric YamlBeans XML Entity Expansion vulnerability"
}
GHSA-VJ8X-7V7M-G9V3
Vulnerability from github – Published: 2022-05-14 03:19 – Updated: 2022-05-14 03:19In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, Dell EMC VNXe3200 Operating Environment (OE) all versions, Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC ViPR SRM versions 4.0, 4.0.1, 4.0.2, 4.0.3 (only if using Dell EMC Host Interface for Windows), Dell EMC XtremIO versions 4.x, Dell EMC VMAX eNAS version 8.x, Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968, ECOM is affected by a XXE injection vulnerability due to the configuration of the XML parser shipped with the product. XXE Injection attack may occur when XML input containing a reference to an external entity (defined by the attacker) is processed by an affected XML parser. XXE Injection may allow attackers to gain unauthorized access to files containing sensitive information or may be used to cause denial-of-service.
{
"affected": [],
"aliases": [
"CVE-2018-1183"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-30T20:29:00Z",
"severity": "CRITICAL"
},
"details": "In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, Dell EMC VNXe3200 Operating Environment (OE) all versions, Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC ViPR SRM versions 4.0, 4.0.1, 4.0.2, 4.0.3 (only if using Dell EMC Host Interface for Windows), Dell EMC XtremIO versions 4.x, Dell EMC VMAX eNAS version 8.x, Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968, ECOM is affected by a XXE injection vulnerability due to the configuration of the XML parser shipped with the product. XXE Injection attack may occur when XML input containing a reference to an external entity (defined by the attacker) is processed by an affected XML parser. XXE Injection may allow attackers to gain unauthorized access to files containing sensitive information or may be used to cause denial-of-service.",
"id": "GHSA-vj8x-7v7m-g9v3",
"modified": "2022-05-14T03:19:05Z",
"published": "2022-05-14T03:19:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1183"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2018/Apr/61"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104024"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VJF8-HC3F-MPW4
Vulnerability from github – Published: 2022-07-30 00:00 – Updated: 2022-08-05 00:00Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
{
"affected": [],
"aliases": [
"CVE-2022-2414"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-29T19:15:00Z",
"severity": "HIGH"
},
"details": "Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.",
"id": "GHSA-vjf8-hc3f-mpw4",
"modified": "2022-08-05T00:00:23Z",
"published": "2022-07-30T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2414"
},
{
"type": "WEB",
"url": "https://github.com/dogtagpki/pki/pull/4021"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VJG9-7379-XQ82
Vulnerability from github – Published: 2022-02-26 00:00 – Updated: 2022-03-05 00:00In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible.
{
"affected": [],
"aliases": [
"CVE-2022-24340"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-25T15:15:00Z",
"severity": "CRITICAL"
},
"details": "In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible.",
"id": "GHSA-vjg9-7379-xq82",
"modified": "2022-03-05T00:00:54Z",
"published": "2022-02-26T00:00:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24340"
},
{
"type": "WEB",
"url": "https://blog.jetbrains.com"
},
{
"type": "WEB",
"url": "https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VJR7-9X47-6RJ6
Vulnerability from github – Published: 2024-10-16 18:31 – Updated: 2024-10-16 18:31IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.
{
"affected": [],
"aliases": [
"CVE-2024-45072"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-16T17:15:16Z",
"severity": "MODERATE"
},
"details": "IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.",
"id": "GHSA-vjr7-9x47-6rj6",
"modified": "2024-10-16T18:31:47Z",
"published": "2024-10-16T18:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45072"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7173263"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-VJV6-GQ77-3MJW
Vulnerability from github – Published: 2020-07-07 16:32 – Updated: 2023-06-27 20:27Impact
A user can do to an XML External Entity (XXE) attack with the provided SDL style.
Patches
Use version >= 3.24
Workarounds
No
References
- https://cwe.mitre.org/data/definitions/611.html
- https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e
For more information
If you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.mapfish.print:print-lib"
},
"ranges": [
{
"events": [
{
"introduced": "3.0"
},
{
"fixed": "3.24"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.mapfish.print:print-servlet"
},
"ranges": [
{
"events": [
{
"introduced": "3.0"
},
{
"fixed": "3.24"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.mapfish.print:print-standalone"
},
"ranges": [
{
"events": [
{
"introduced": "3.0"
},
{
"fixed": "3.24"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-15232"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-07-07T16:32:20Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Impact\nA user can do to an XML External Entity (XXE) attack with the provided SDL style.\n\n### Patches\nUse version \u003e= 3.24\n\n### Workarounds\nNo\n\n### References\n* https://cwe.mitre.org/data/definitions/611.html\n* https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e\n\n### For more information\nIf you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397\n",
"id": "GHSA-vjv6-gq77-3mjw",
"modified": "2023-06-27T20:27:43Z",
"published": "2020-07-07T16:32:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-vjv6-gq77-3mjw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15232"
},
{
"type": "WEB",
"url": "https://github.com/mapfish/mapfish-print/pull/1397"
},
{
"type": "WEB",
"url": "https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e"
},
{
"type": "PACKAGE",
"url": "https://github.com/mapfish/mapfish-print"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "XXE attack in Mapfish Print"
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.