CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1697 vulnerabilities reference this CWE, most recent first.
GHSA-VX84-5FHG-PF9V
Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2024-04-04 01:48xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi.
{
"affected": [],
"aliases": [
"CVE-2019-15641"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-26T18:15:00Z",
"severity": "MODERATE"
},
"details": "xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi.",
"id": "GHSA-vx84-5fhg-pf9v",
"modified": "2024-04-04T01:48:12Z",
"published": "2022-05-24T16:54:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15641"
},
{
"type": "WEB",
"url": "https://www.calypt.com/blog/index.php/authenticated-xxe-on-webmin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W23F-22PX-MX2G
Vulnerability from github – Published: 2024-12-10 15:32 – Updated: 2024-12-10 15:32A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All versions), COMOS V10.4.3 (All versions < V10.4.3.0.47), COMOS V10.4.4 (All versions < V10.4.4.2), COMOS V10.4.4.1 (All versions < V10.4.4.1.21). The PDMS/E3D Engineering Interface improperly handles XML External Entity (XXE) entries when communicating with an external application. This could allow an attacker to extract any file with a known location on the user's system or accessible network folders by injecting malicious data into the communication channel between the two systems.
{
"affected": [],
"aliases": [
"CVE-2024-54005"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-10T14:30:47Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in COMOS V10.3 (All versions \u003c V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All versions), COMOS V10.4.3 (All versions \u003c V10.4.3.0.47), COMOS V10.4.4 (All versions \u003c V10.4.4.2), COMOS V10.4.4.1 (All versions \u003c V10.4.4.1.21). The PDMS/E3D Engineering Interface improperly handles XML External Entity (XXE) entries when communicating with an external application. This could allow an attacker to extract any file with a known location on the user\u0027s system or accessible network folders by injecting malicious data into the communication channel between the two systems.",
"id": "GHSA-w23f-22px-mx2g",
"modified": "2024-12-10T15:32:31Z",
"published": "2024-12-10T15:32:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54005"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-701627.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-W28F-FWQ3-X4P2
Vulnerability from github – Published: 2022-05-17 02:54 – Updated: 2025-04-20 03:33XML external entity (XXE) vulnerability in eParakstitajs 3 before 1.3.9 and eParaksts Java lib before 2.5.13 allows remote attackers to read arbitrary files or possibly have unspecified other impact via a crafted edoc file.
{
"affected": [],
"aliases": [
"CVE-2017-6055"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-17T20:59:00Z",
"severity": "HIGH"
},
"details": "XML external entity (XXE) vulnerability in eParakstitajs 3 before 1.3.9 and eParaksts Java lib before 2.5.13 allows remote attackers to read arbitrary files or possibly have unspecified other impact via a crafted edoc file.",
"id": "GHSA-w28f-fwq3-x4p2",
"modified": "2025-04-20T03:33:04Z",
"published": "2022-05-17T02:54:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6055"
},
{
"type": "WEB",
"url": "https://cert.lv/lv/2017/02/iznakusas-nedelas-zinas-par-drosibas-incidentiem-nr-4-2017"
},
{
"type": "WEB",
"url": "https://www.eparaksts.lv/en/Assistance/downloads/eparakstitajs-3-0/previous-versions-of-eparakstitajs-3-0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W2J7-XP4W-PRX7
Vulnerability from github – Published: 2022-05-14 02:19 – Updated: 2022-05-14 02:19Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow XXE.
{
"affected": [],
"aliases": [
"CVE-2018-11719"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-30T16:29:00Z",
"severity": "MODERATE"
},
"details": "Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow XXE.",
"id": "GHSA-w2j7-xp4w-prx7",
"modified": "2022-05-14T02:19:43Z",
"published": "2022-05-14T02:19:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11719"
},
{
"type": "WEB",
"url": "https://xovis.com/security/xovis-sec-2018-002.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W2PW-52QG-478G
Vulnerability from github – Published: 2026-04-28 21:36 – Updated: 2026-04-28 21:36A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process.
{
"affected": [],
"aliases": [
"CVE-2026-6807"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-28T19:37:47Z",
"severity": "MODERATE"
},
"details": "A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to \ntrigger improper handling of XML input, which may result in unintended \nexposure of sensitive information. The flaw stems from insufficient \nhardening of the XML parsing process.",
"id": "GHSA-w2pw-52qg-478g",
"modified": "2026-04-28T21:36:14Z",
"published": "2026-04-28T21:36:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6807"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-118-01.json"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-118-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W358-HQ9X-MWXH
Vulnerability from github – Published: 2022-05-14 02:21 – Updated: 2022-05-14 02:21In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running UMS, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.
{
"affected": [],
"aliases": [
"CVE-2018-13416"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-03T17:29:00Z",
"severity": "CRITICAL"
},
"details": "In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running UMS, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.",
"id": "GHSA-w358-hq9x-mwxh",
"modified": "2022-05-14T02:21:02Z",
"published": "2022-05-14T02:21:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13416"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/45133"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2018/Jul/94"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W35X-898H-QG79
Vulnerability from github – Published: 2024-03-22 21:30 – Updated: 2024-03-22 21:30A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257716.
{
"affected": [],
"aliases": [
"CVE-2024-2826"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-22T19:15:08Z",
"severity": "MODERATE"
},
"details": "A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257716.",
"id": "GHSA-w35x-898h-qg79",
"modified": "2024-03-22T21:30:56Z",
"published": "2024-03-22T21:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2826"
},
{
"type": "WEB",
"url": "https://gitee.com/lakernote/easy-admin/issues/I98ZTA"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.257716"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.257716"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-W375-34XX-JHPQ
Vulnerability from github – Published: 2022-05-24 16:53 – Updated: 2024-04-04 01:38The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files.
{
"affected": [],
"aliases": [
"CVE-2019-0340"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-14T14:15:00Z",
"severity": "MODERATE"
},
"details": "The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files.",
"id": "GHSA-w375-34xx-jhpq",
"modified": "2024-04-04T01:38:49Z",
"published": "2022-05-24T16:53:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0340"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2794742"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W3PC-7G8W-9V7J
Vulnerability from github – Published: 2022-10-04 00:00 – Updated: 2022-10-05 00:00An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) injection attack through the nbars process.
{
"affected": [],
"aliases": [
"CVE-2022-42301"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-03T15:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) injection attack through the nbars process.",
"id": "GHSA-w3pc-7g8w-9v7j",
"modified": "2022-10-05T00:00:37Z",
"published": "2022-10-04T00:00:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42301"
},
{
"type": "WEB",
"url": "https://www.veritas.com/content/support/en_US/security/VTS22-013#M1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W3V2-46WF-PQ33
Vulnerability from github – Published: 2022-05-05 02:48 – Updated: 2025-11-25 18:32expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
{
"affected": [],
"aliases": [
"CVE-2013-0340"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-01-21T18:55:00Z",
"severity": "MODERATE"
},
"details": "expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.",
"id": "GHSA-w3v2-46wf-pq33",
"modified": "2025-11-25T18:32:00Z",
"published": "2022-05-05T02:48:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0340"
},
{
"type": "WEB",
"url": "https://github.com/libexpat/libexpat/blob/R_2_4_1/expat/Changes"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7cc5fada6d%40%3Cannounce.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7cc5fada6d@%3Cannounce.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702%40%3Cusers.openoffice.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702@%3Cusers.openoffice.apache.org%3E"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201701-21"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT212804"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT212805"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT212807"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT212814"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT212815"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT212819"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2013/02/22/3"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/Oct/61"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/Oct/62"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/Oct/63"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/Sep/33"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/Sep/34"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/Sep/35"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/Sep/38"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/Sep/39"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/Sep/40"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1028213"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/04/12/6"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/10/07/4"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/90634"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/58233"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.