Common Weakness Enumeration

CWE-611

Allowed

Improper Restriction of XML External Entity Reference

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

1697 vulnerabilities reference this CWE, most recent first.

GHSA-W89V-55CW-2PM8

Vulnerability from github – Published: 2022-05-24 16:52 – Updated: 2024-04-04 01:31
VLAI
Details

cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).

Severity
6.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-18438"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-08-02T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).",
  "id": "GHSA-w89v-55cw-2pm8",
  "modified": "2024-04-04T01:31:10Z",
  "published": "2022-05-24T16:52:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18438"
    },
    {
      "type": "WEB",
      "url": "https://documentation.cpanel.net/display/CL/64+Change+Log"
    },
    {
      "type": "WEB",
      "url": "https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-W9J7-PHM3-F97J

Vulnerability from github – Published: 2024-12-13 20:35 – Updated: 2024-12-13 20:35
VLAI
Summary
Ucum-java has an XXE vulnerability in XML parsing
Details

Impact

XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML.

Patches

Release 1.0.9 of ucum fixes this vulnerability

Workarounds

Ensure that the source xml for instantiating UcumEssenceService is trusted.

References

  • https://cwe.mitre.org/data/definitions/611.html
  • https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j
Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.fhir:ucum"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-55887"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-13T20:35:57Z",
    "nvd_published_at": "2024-12-13T16:15:28Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nXML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML.\n\n### Patches\nRelease 1.0.9 of ucum fixes this vulnerability\n\n### Workarounds\nEnsure that the source xml for instantiating UcumEssenceService is trusted.\n\n### References\n* https://cwe.mitre.org/data/definitions/611.html\n* https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j\n",
  "id": "GHSA-w9j7-phm3-f97j",
  "modified": "2024-12-13T20:35:57Z",
  "published": "2024-12-13T20:35:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FHIR/Ucum-java/security/advisories/GHSA-w9j7-phm3-f97j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55887"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FHIR/Ucum-java"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Ucum-java has an XXE vulnerability in XML parsing"
}

GHSA-W9P6-VQ7Q-W6Q7

Vulnerability from github – Published: 2023-04-27 00:30 – Updated: 2024-04-04 03:42
VLAI
Details

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-45876"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-26T22:15:08Z",
    "severity": "MODERATE"
  },
  "details": "Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.\n\n",
  "id": "GHSA-w9p6-vq7q-w6q7",
  "modified": "2024-04-04T03:42:23Z",
  "published": "2023-04-27T00:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45876"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05"
    },
    {
      "type": "WEB",
      "url": "https://www.vbase.net/en/download.php"
    },
    {
      "type": "WEB",
      "url": "https://www.visam.com/kontakt.php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WC53-4255-GW3F

Vulnerability from github – Published: 2025-04-04 14:20 – Updated: 2025-04-04 14:20
VLAI
Summary
The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server
Details

Impact

If the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIRA URL that returns an XML specifying a DOCTYPE pointing to a local file on the XWiki server host and displaying that file's content in one of the returned JIRA fields (such as the summary or description for example).

For example:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<rss version="0.92">
...
    <item>
      <title>&xxe;</title>
      <link>https://jira.xwiki.org/browse/XE-307</link>
      <project id="10222" key="XE">{RETIRED} XWiki Enterprise</project>
      <description>&xxe;</description>
      <environment/>
...

Patches

The vulnerability has been patched in the JIRA Extension v8.6.5.

Workarounds

No easy workaround except to upgrade (which is easy using the XWiki Extension Manager).

References

  • https://github.com/xwiki-contrib/jira/commit/98a74c2a516b42689c73b13ecd94e9c1998fa9cb and https://github.com/xwiki-contrib/jira/commit/5049e352d16f8356734de70daf1202301f170ee6
  • https://jira.xwiki.org/browse/JIRA-49

For more information

If you have any questions or comments about this advisory: * Open an issue in Jira XWiki.org * Email us at Security Mailing List

Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.contrib.jira:jira-macro-default"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2"
            },
            {
              "fixed": "8.5.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-31487"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-04T14:20:18Z",
    "nvd_published_at": "2025-04-03T19:15:40Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nIf the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIRA URL that returns an XML specifying a DOCTYPE pointing to a local file on the XWiki server host and displaying that file\u0027s content in one of the returned JIRA fields (such as the summary or description for example).\n\nFor example:\n\n```\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003c!DOCTYPE foo [ \u003c!ENTITY xxe SYSTEM \"file:///etc/passwd\"\u003e ]\u003e\n\u003crss version=\"0.92\"\u003e\n...\n    \u003citem\u003e\n      \u003ctitle\u003e\u0026xxe;\u003c/title\u003e\n      \u003clink\u003ehttps://jira.xwiki.org/browse/XE-307\u003c/link\u003e\n      \u003cproject id=\"10222\" key=\"XE\"\u003e{RETIRED} XWiki Enterprise\u003c/project\u003e\n      \u003cdescription\u003e\u0026xxe;\u003c/description\u003e\n      \u003cenvironment/\u003e\n...\n```\n\n### Patches\nThe vulnerability has been patched in the JIRA Extension v8.6.5.\n\n### Workarounds\nNo easy workaround except to upgrade (which is easy using the XWiki Extension Manager).\n\n### References\n* https://github.com/xwiki-contrib/jira/commit/98a74c2a516b42689c73b13ecd94e9c1998fa9cb and https://github.com/xwiki-contrib/jira/commit/5049e352d16f8356734de70daf1202301f170ee6\n* https://jira.xwiki.org/browse/JIRA-49\n\n### For more information\nIf you have any questions or comments about this advisory:\n*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n*    Email us at [Security Mailing List](mailto:security@xwiki.org)",
  "id": "GHSA-wc53-4255-gw3f",
  "modified": "2025-04-04T14:20:18Z",
  "published": "2025-04-04T14:20:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki-contrib/jira/security/advisories/GHSA-wc53-4255-gw3f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31487"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki-contrib/jira/commit/5049e352d16f8356734de70daf1202301f170ee6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki-contrib/jira/commit/98a74c2a516b42689c73b13ecd94e9c1998fa9cb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki-contrib/jira"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/JIRA-49"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server"
}

GHSA-WC5V-H4FQ-4G72

Vulnerability from github – Published: 2022-07-28 00:00 – Updated: 2022-08-06 00:00
VLAI
Details

VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-42537"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-27T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.",
  "id": "GHSA-wc5v-h4fq-4g72",
  "modified": "2022-08-06T00:00:49Z",
  "published": "2022-07-28T00:00:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42537"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WC63-92VQ-35GR

Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2022-05-24 19:02
VLAI
Details

In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-30006"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-11T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure.",
  "id": "GHSA-wc63-92vq-35gr",
  "modified": "2022-05-24T19:02:09Z",
  "published": "2022-05-24T19:02:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30006"
    },
    {
      "type": "WEB",
      "url": "https://blog.jetbrains.com"
    },
    {
      "type": "WEB",
      "url": "https://blog.jetbrains.com/blog/2021/05/07/jetbrains-security-bulletin-q1-2021"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-WC97-7623-RXWX

Vulnerability from github – Published: 2022-05-01 00:00 – Updated: 2022-05-18 18:58
VLAI
Summary
Multiple components in Apache NiFi do not restrict XML External Entity references
Details

Apache NiFi is a system to process and distribute data. Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted XML files. The following Processors attempt to resolve XML External Entity references when configured with default property values: - EvaluateXPath - EvaluateXQuery - ValidateXml

Apache NiFi flow configurations that include these Processors are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. NiFi 1.16.1 disables Document Type Declarations in the default configuration for these Processors and disallows XML External Entity resolution in standard services.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.nifi:nifi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.1"
            },
            {
              "fixed": "1.16.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-29265"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-05-18T18:58:58Z",
    "nvd_published_at": "2022-04-30T08:15:00Z",
    "severity": "HIGH"
  },
  "details": "Apache NiFi is a system to process and distribute data. Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted XML files. The following Processors attempt to resolve XML External Entity references when configured with default property values: \n- EvaluateXPath \n- EvaluateXQuery \n- ValidateXml \n\nApache NiFi flow configurations that include these Processors are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. NiFi 1.16.1 disables Document Type Declarations in the default configuration for these Processors and disallows XML External Entity resolution in standard services.",
  "id": "GHSA-wc97-7623-rxwx",
  "modified": "2022-05-18T18:58:58Z",
  "published": "2022-05-01T00:00:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29265"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/nifi"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/47od9kr9n4cyv0mv81jh3pkyx815kyjl"
    },
    {
      "type": "WEB",
      "url": "https://nifi.apache.org/security.html#CVE-2022-29265"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Multiple components in Apache NiFi do not restrict XML External Entity references"
}

GHSA-WC9J-GC65-3CM7

Vulnerability from github – Published: 2023-08-31 21:47 – Updated: 2023-08-31 21:47
VLAI
Summary
DDFFileParser is vulnerable to XXE Attacks
Details

Impact

DDFFileParser and DefaultDDFFileValidator (and so ObjectLoader) are vulnerable to XXE Attacks.

DDF file is a LWM2M format used to store LWM2M object description.
Leshan users are impacted only if they parse untrusted DDF files (e.g. if they let external users provide their own model), in that case they MUST upgrade to fixed version. If you parse only trusted DDF file and validate only with trusted xml schema, upgrading is not mandatory.

Patches

This is fixed in v1.5.0 and 2.0.0-M13.

Workarounds

No easy way. Eventually writing your own DDFFileParser/DefaultDDFFileValidator (and so ObjectLoader) creating a DocumentBuilderFactory with : 

// For DDFFileParser
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); // Disable DTDs
factory.setXIncludeAware(false); // Disable XML Inclusions
factory.setExpandEntityReferences(false); // disable expand entity reference nodes

// For DefaultDDFFileValidator
SchemaFactory factory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");

References

  • https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
  • https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
  • https://semgrep.dev/docs/cheat-sheets/java-xxe/
  • https://community.veracode.com/s/article/Java-Remediation-Guidance-for-XXE
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.leshan:leshan-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.leshan:leshan-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-M1"
            },
            {
              "fixed": "2.0.0-M13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-41034"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-31T21:47:28Z",
    "nvd_published_at": "2023-08-31T18:15:09Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n`DDFFileParser` and `DefaultDDFFileValidator` (and so `ObjectLoader`) are vulnerable to [XXE Attacks](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing).\n\n[DDF file](https://github.com/eclipse-leshan/leshan/wiki/Adding-new-objects#the-lwm2m-model) is a LWM2M format used to store LWM2M object description.   \nLeshan users are impacted only if they parse untrusted DDF files (e.g. if they let external users provide their own model), in that case they MUST upgrade to fixed version.\nIf you parse only trusted DDF file and validate only with trusted xml schema, upgrading is not mandatory. \n\n### Patches\nThis is fixed in **v1.5.0** and **2.0.0-M13**.\n\n### Workarounds\nNo easy way. Eventually writing your own `DDFFileParser`/`DefaultDDFFileValidator` (and so `ObjectLoader`) creating a `DocumentBuilderFactory` with : \n```java\n// For DDFFileParser\nDocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();\nfactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);\nfactory.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true); // Disable DTDs\nfactory.setXIncludeAware(false); // Disable XML Inclusions\nfactory.setExpandEntityReferences(false); // disable expand entity reference nodes\n\n// For DefaultDDFFileValidator\nSchemaFactory factory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);\nfactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);\nfactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\");\nfactory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\");\n``` \n\n### References\n- https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing\n- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html\n- https://semgrep.dev/docs/cheat-sheets/java-xxe/\n- https://community.veracode.com/s/article/Java-Remediation-Guidance-for-XXE",
  "id": "GHSA-wc9j-gc65-3cm7",
  "modified": "2023-08-31T21:47:28Z",
  "published": "2023-08-31T21:47:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/eclipse-leshan/leshan/security/advisories/GHSA-wc9j-gc65-3cm7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41034"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eclipse-leshan/leshan/commit/29577d2879ba8e7674c3b216a7f01193fc7ae013"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eclipse-leshan/leshan/commit/4d3e63ac271a817f81fba3e3229c519af7a3049c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/eclipse-leshan/leshan"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eclipse-leshan/leshan/wiki/Adding-new-objects#the-lwm2m-model"
    },
    {
      "type": "WEB",
      "url": "https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "DDFFileParser is vulnerable to XXE Attacks"
}

GHSA-WCM6-QR3C-R573

Vulnerability from github – Published: 2022-11-05 12:00 – Updated: 2022-11-09 12:00
VLAI
Details

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injection via a custom View. The XXE injection causes Splunk Web to embed incorrect documents into an error.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-43570"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-04T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injection via a custom View. The XXE injection causes Splunk Web to embed incorrect documents into an error.",
  "id": "GHSA-wcm6-qr3c-r573",
  "modified": "2022-11-09T12:00:24Z",
  "published": "2022-11-05T12:00:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43570"
    },
    {
      "type": "WEB",
      "url": "https://www.splunk.com/en_us/product-security/announcements/svd-2022-1110.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WCP5-M52F-MHH5

Vulnerability from github – Published: 2021-05-07 15:54 – Updated: 2022-09-08 14:05
VLAI
Summary
Improper Restriction of XML External Entity Reference in MPXJ
Details

"MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components."

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "net.sf.mpxj:mpxj"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-25020"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-05T19:48:23Z",
    "nvd_published_at": "2020-08-29T19:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "\"MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components.\"",
  "id": "GHSA-wcp5-m52f-mhh5",
  "modified": "2022-09-08T14:05:32Z",
  "published": "2021-05-07T15:54:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25020"
    },
    {
      "type": "WEB",
      "url": "https://github.com/joniles/mpxj/pull/178/commits/c3e457f7a16facfe563eade82b0fa8736a8c96f9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/joniles/mpxj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/joniles/mpxj/releases/tag/v8.1.4"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Restriction of XML External Entity Reference in MPXJ"
}
Mitigation
Implementation System Configuration

Many XML parsers and validators can be configured to disable external entity expansion.

CAPEC-221: Data Serialization External Entities Blowup

This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.

← Back to the CWE list