CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1697 vulnerabilities reference this CWE, most recent first.
GHSA-WCRG-92WP-4H28
Vulnerability from github – Published: 2022-05-24 17:30 – Updated: 2023-10-27 11:58Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers with Overall/Read permission to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Additionally, XML parsing is exposed as a form validation endpoint that does not require POST requests, allowing exploitation by users without Overall/Read permission via CSRF.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:nerrvana-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.02.06"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2298"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-21T18:52:12Z",
"nvd_published_at": "2020-10-08T13:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers with Overall/Read permission to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.\n\nAdditionally, XML parsing is exposed as a form validation endpoint that does not require POST requests, allowing exploitation by users without Overall/Read permission via CSRF.",
"id": "GHSA-wcrg-92wp-4h28",
"modified": "2023-10-27T11:58:39Z",
"published": "2022-05-24T17:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2298"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/nerrvana-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-2097"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/10/08/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in Jenkins Nerrvana Plugin"
}
GHSA-WF8M-QR47-XC9M
Vulnerability from github – Published: 2023-07-06 19:24 – Updated: 2023-07-06 21:55Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers able to control Project File (APX) contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:absint-a3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-28685"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-06T21:55:57Z",
"nvd_published_at": "2023-03-22T06:15:00Z",
"severity": "HIGH"
},
"details": "Jenkins AbsInt a\u00b3 Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers able to control `Project File (APX)` contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.",
"id": "GHSA-wf8m-qr47-xc9m",
"modified": "2023-07-06T21:55:57Z",
"published": "2023-07-06T19:24:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28685"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2930"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins AbsInt a\u00b3 Plugin XML External Entity Reference vulnerability"
}
GHSA-WFJ4-9275-FH6P
Vulnerability from github – Published: 2022-05-17 00:18 – Updated: 2022-05-17 00:18TablePress prior to version 1.8.1 allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2017-10889"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-17T14:29:00Z",
"severity": "MODERATE"
},
"details": "TablePress prior to version 1.8.1 allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors.",
"id": "GHSA-wfj4-9275-fh6p",
"modified": "2022-05-17T00:18:38Z",
"published": "2022-05-17T00:18:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10889"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN05398317/index.html"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/tablepress/#developers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WFXP-4QGW-QP3C
Vulnerability from github – Published: 2022-03-18 17:52 – Updated: 2022-03-18 17:52Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:xcode-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21656"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-19T19:20:58Z",
"nvd_published_at": "2021-05-11T15:15:00Z",
"severity": "HIGH"
},
"details": "Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.",
"id": "GHSA-wfxp-4qgw-qp3c",
"modified": "2022-03-18T17:52:43Z",
"published": "2022-03-18T17:52:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21656"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/xcode-plugin/commit/01335f1f4734e4a7eda69b28e182ecd4c34a1a4b"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2335"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "XML external entity (XXE) attacks in Jenkins Xcode integration Plugin"
}
GHSA-WG99-5VRX-J2GG
Vulnerability from github – Published: 2023-01-05 12:30 – Updated: 2023-01-11 23:01A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 can address this issue. The name of the patch is a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.bonitasoft.connectors:bonita-connector-webservice"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-36640"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-09T20:04:58Z",
"nvd_published_at": "2023-01-05T10:15:00Z",
"severity": "CRITICAL"
},
"details": "A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function `TransformerConfigurationException` of the file `src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java`. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 can address this issue. The name of the patch is a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443.",
"id": "GHSA-wg99-5vrx-j2gg",
"modified": "2023-01-11T23:01:28Z",
"published": "2023-01-05T12:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36640"
},
{
"type": "WEB",
"url": "https://github.com/bonitasoft/bonita-connector-webservice/pull/17"
},
{
"type": "WEB",
"url": "https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5"
},
{
"type": "PACKAGE",
"url": "https://github.com/bonitasoft/bonita-connector-webservice"
},
{
"type": "WEB",
"url": "https://github.com/bonitasoft/bonita-connector-webservice/releases/tag/1.3.1"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.217443"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.217443"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "bonita-connector-webservice XML External Entity vulnerability"
}
GHSA-WGFC-HM58-HX63
Vulnerability from github – Published: 2024-01-29 21:30 – Updated: 2024-01-29 21:30Improper Restriction of XML External Entity Reference vulnerability in OpenText AppBuilder on Windows, Linux allows Server Side Request Forgery, Probe System Files.
AppBuilder's XML processor is vulnerable to XML External Entity Processing (XXE), allowing an authenticated user to upload specially crafted XML files to induce server-side request forgery, disclose files local to the server that processes them.
This issue affects AppBuilder: from 21.2 before 23.2.
{
"affected": [],
"aliases": [
"CVE-2023-4554"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-29T21:15:09Z",
"severity": "MODERATE"
},
"details": "Improper Restriction of XML External Entity Reference vulnerability in OpenText AppBuilder on Windows, Linux allows Server Side Request Forgery, Probe System Files.\n\nAppBuilder\u0027s XML processor is vulnerable to XML External Entity Processing (XXE), allowing an authenticated user to upload specially crafted XML files to induce server-side request forgery, disclose files local to the server that processes them.\n\n\nThis issue affects AppBuilder: from 21.2 before 23.2.\n\n",
"id": "GHSA-wgfc-hm58-hx63",
"modified": "2024-01-29T21:30:27Z",
"published": "2024-01-29T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4554"
},
{
"type": "WEB",
"url": "https://support.opentext.com/csm?id=ot_kb_search\u0026kb_category=61648712db61781068cfd6c4e296197b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WGPP-G6V9-7HXP
Vulnerability from github – Published: 2022-12-12 09:30 – Updated: 2022-12-12 22:20Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers able to control XML input files for the 'Plot build data' build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Plot Plugin 2.1.12 disables external entity resolution for its XML parser.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:plot"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-46682"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-12T22:20:51Z",
"nvd_published_at": "2022-12-12T09:15:00Z",
"severity": "HIGH"
},
"details": "Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers able to control XML input files for the \u0027Plot build data\u0027 build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.\n\nPlot Plugin 2.1.12 disables external entity resolution for its XML parser.\n\n",
"id": "GHSA-wgpp-g6v9-7hxp",
"modified": "2022-12-12T22:20:51Z",
"published": "2022-12-12T09:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46682"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/plot-plugin/commit/4f7afbe064aab538a242a9984e583e513863e0ac"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/plot-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-12-07/#SECURITY-2940"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Plot Plugin XML External Entity Reference vulnerability"
}
GHSA-WGQF-5547-MC5W
Vulnerability from github – Published: 2022-05-17 02:51 – Updated: 2022-05-17 02:51IBM Jazz Foundation is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 2000784.
{
"affected": [],
"aliases": [
"CVE-2016-9707"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-31T18:59:00Z",
"severity": "HIGH"
},
"details": "IBM Jazz Foundation is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 2000784.",
"id": "GHSA-wgqf-5547-mc5w",
"modified": "2022-05-17T02:51:55Z",
"published": "2022-05-17T02:51:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9707"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/docview.wss?uid=swg22000784"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97171"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WGW7-G744-RPHQ
Vulnerability from github – Published: 2024-12-20 15:30 – Updated: 2024-12-20 15:30In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack
{
"affected": [],
"aliases": [
"CVE-2024-56356"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-20T15:15:09Z",
"severity": "MODERATE"
},
"details": "In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack",
"id": "GHSA-wgw7-g744-rphq",
"modified": "2024-12-20T15:30:48Z",
"published": "2024-12-20T15:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56356"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WHF4-FPJ8-PGG8
Vulnerability from github – Published: 2024-06-07 21:31 – Updated: 2025-03-31 13:36An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ebookmeta"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-36827"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-07T21:54:40Z",
"nvd_published_at": "2024-06-07T19:15:24Z",
"severity": "HIGH"
},
"details": "An XML External Entity (XXE) vulnerability in the `ebookmeta.get_metadata` function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.",
"id": "GHSA-whf4-fpj8-pgg8",
"modified": "2025-03-31T13:36:20Z",
"published": "2024-06-07T21:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36827"
},
{
"type": "WEB",
"url": "https://github.com/dnkorpushov/ebookmeta/issues/16#issue-2317712335"
},
{
"type": "PACKAGE",
"url": "https://github.com/dnkorpushov/ebookmeta"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/ebookmeta/PYSEC-2024-76.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "ebookmeta XML External Entity vulnerability"
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.