CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1699 vulnerabilities reference this CWE, most recent first.
GHSA-67V4-R89V-8632
Vulnerability from github – Published: 2022-05-17 03:37 – Updated: 2022-05-17 03:37The XML parser in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allows remote authenticated users to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
{
"affected": [],
"aliases": [
"CVE-2016-0284"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-11-24T19:59:00Z",
"severity": "MODERATE"
},
"details": "The XML parser in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allows remote authenticated users to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"id": "GHSA-67v4-r89v-8632",
"modified": "2022-05-17T03:37:41Z",
"published": "2022-05-17T03:37:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0284"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21991478"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94555"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-683X-4444-JXH8
Vulnerability from github – Published: 2024-06-24 20:44 – Updated: 2024-06-28 18:58Impact
Before deserializing CycloneDX Bill of Materials in XML format, cyclonedx-core-java leverages XPath expressions to determine the schema version of the BOM. The DocumentBuilderFactory used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection.
XXE injection can be exploited to exfiltrate local file content, or perform Server Side Request Forgery (SSRF) to access infrastructure adjacent to the vulnerable application.
PoC
import org.cyclonedx.parsers.XmlParser;
class Poc {
public static void main(String[] args) {
// Will throw org.cyclonedx.exception.ParseException: java.net.ConnectException: Connection refused
new XmlParser().parse("""
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE bom [<!ENTITY % sp SYSTEM "https://localhost:1010/does-not-exist/file.dtd"> %sp;]>
<bom xmlns="http://cyclonedx.org/schema/bom/1.5"/>
""".getBytes());
}
}
Patches
The vulnerability has been fixed in cyclonedx-core-java version 0.9.4.
Workarounds
If feasible, applications can reject XML documents before handing them to cyclonedx-core-java for parsing. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.
References
- Issue was fixed via https://github.com/CycloneDX/cyclonedx-core-java/pull/434
- Issue was introduced via https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9
- https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xpathexpression
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.cyclonedx:cyclonedx-core-java"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "9.0.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-38374"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-24T20:44:48Z",
"nvd_published_at": "2024-06-28T18:15:04Z",
"severity": "HIGH"
},
"details": "### Impact\n\nBefore deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection.\n\nXXE injection can be exploited to exfiltrate local file content, or perform Server Side Request Forgery (SSRF) to access infrastructure adjacent to the vulnerable application.\n\n### PoC\n\n```java\nimport org.cyclonedx.parsers.XmlParser;\n\nclass Poc {\n\n public static void main(String[] args) {\n // Will throw org.cyclonedx.exception.ParseException: java.net.ConnectException: Connection refused\n new XmlParser().parse(\"\"\"\n \u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n \u003c!DOCTYPE bom [\u003c!ENTITY % sp SYSTEM \"https://localhost:1010/does-not-exist/file.dtd\"\u003e %sp;]\u003e\n \u003cbom xmlns=\"http://cyclonedx.org/schema/bom/1.5\"/\u003e\n \"\"\".getBytes());\n }\n\n}\n```\n\n### Patches\n\nThe vulnerability has been fixed in _cyclonedx-core-java_ version 0.9.4.\n\n### Workarounds\n\nIf feasible, applications can reject XML documents before handing them to _cyclonedx-core-java_ for parsing.\nThis may be an option if incoming CycloneDX BOMs are known to be in JSON format.\n\n### References\n\n* Issue was fixed via \u003chttps://github.com/CycloneDX/cyclonedx-core-java/pull/434\u003e\n* Issue was introduced via \u003chttps://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9\u003e\n* \u003chttps://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing\u003e\n* \u003chttps://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xpathexpression\u003e\n",
"id": "GHSA-683x-4444-jxh8",
"modified": "2024-06-28T18:58:48Z",
"published": "2024-06-24T20:44:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38374"
},
{
"type": "WEB",
"url": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434"
},
{
"type": "WEB",
"url": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434/commits/ab0bc9c530d24f737970dbd0287d1190b129853d"
},
{
"type": "PACKAGE",
"url": "https://github.com/CycloneDX/cyclonedx-core-java"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java"
}
GHSA-685X-Q7J3-8C52
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose sensitive data on the server, denial of service, or server side request forgery.
{
"affected": [],
"aliases": [
"CVE-2017-3206"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-11T17:29:00Z",
"severity": "CRITICAL"
},
"details": "The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose sensitive data on the server, denial of service, or server side request forgery.",
"id": "GHSA-685x-q7j3-8c52",
"modified": "2022-05-13T01:36:43Z",
"published": "2022-05-13T01:36:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3206"
},
{
"type": "WEB",
"url": "https://codewhitesec.blogspot.com/2017/04/amf.html"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/307983"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97380"
},
{
"type": "WEB",
"url": "http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-687X-269M-7CV9
Vulnerability from github – Published: 2022-05-14 03:46 – Updated: 2024-01-30 22:36Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.49"
},
"package": {
"ecosystem": "Maven",
"name": "org.jvnet.hudson.plugins:pmd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.50"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1000008"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:36:26Z",
"nvd_published_at": "2018-01-23T14:29:00Z",
"severity": "HIGH"
},
"details": "Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.",
"id": "GHSA-687x-269m-7cv9",
"modified": "2024-01-30T22:36:26Z",
"published": "2022-05-14T03:46:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000008"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2018-01-22"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102844"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in Jenkins PMD Plugin"
}
GHSA-689X-4MP2-JFFR
Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External Entity (XXE) vulnerability.
{
"affected": [],
"aliases": [
"CVE-2018-2401"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-14T19:29:00Z",
"severity": "HIGH"
},
"details": "SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External Entity (XXE) vulnerability.",
"id": "GHSA-689x-4mp2-jffr",
"modified": "2022-05-13T01:32:23Z",
"published": "2022-05-13T01:32:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2401"
},
{
"type": "WEB",
"url": "https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2596766"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103374"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-68HQ-QRC4-W5H8
Vulnerability from github – Published: 2022-05-14 01:42 – Updated: 2022-05-14 01:42K9Mail version <= v5.600 contains a XML External Entity (XXE) vulnerability in WebDAV response parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious WebDAV server or intercept the reponse of a valid WebDAV server.
{
"affected": [],
"aliases": [
"CVE-2018-1000831"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-20T15:29:00Z",
"severity": "CRITICAL"
},
"details": "K9Mail version \u003c= v5.600 contains a XML External Entity (XXE) vulnerability in WebDAV response parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious WebDAV server or intercept the reponse of a valid WebDAV server.",
"id": "GHSA-68hq-qrc4-w5h8",
"modified": "2022-05-14T01:42:26Z",
"published": "2022-05-14T01:42:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000831"
},
{
"type": "WEB",
"url": "https://github.com/k9mail/k-9/issues/3681"
},
{
"type": "WEB",
"url": "https://0dd.zone/2018/10/28/k9mail-XXE-MitM"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-68J8-FP38-P48Q
Vulnerability from github – Published: 2024-09-19 14:49 – Updated: 2024-09-20 14:52Impact
The profile location routine in the referencevalidator commons package is vulnerable to XML External Entities attack due to insecure defaults of the used Woodstox WstxInputFactory. A malicious XML resource can lead to network requests issued by referencevalidator and thus to a Server Side Request Forgery attack.
The vulnerability impacts applications which use referencevalidator to process XML resources from untrusted sources.
Patches
The problem has been patched with the 2.5.1 version of the referencevalidator. Users are strongly recommended to update to this version or a more recent one.
Workarounds
A pre-processing or manual analysis of input XML resources on existence of DTD definitions or external entities can mitigate the problem.
References
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "de.gematik.refv.commons:commons"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-46984"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-09-19T14:49:40Z",
"nvd_published_at": "2024-09-19T23:15:12Z",
"severity": "HIGH"
},
"details": "### Impact\nThe profile location routine in the referencevalidator commons package is vulnerable to [XML External Entities](https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)) attack due to insecure defaults of the used Woodstox WstxInputFactory. A malicious XML resource can lead to network requests issued by referencevalidator and thus to a [Server Side Request Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery) attack.\n\nThe vulnerability impacts applications which use referencevalidator to process XML resources from untrusted sources. \n\n### Patches\nThe problem has been patched with the [2.5.1 version](https://github.com/gematik/app-referencevalidator/releases/tag/2.5.1) of the referencevalidator. Users are strongly recommended to update to this version or a more recent one. \n\n### Workarounds\nA pre-processing or manual analysis of input XML resources on existence of DTD definitions or external entities can mitigate the problem.\n\n### References\n- [OWASP Top 10 XXE](https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)#)\n- [Server Side Request Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n- [OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#transformerfactory)",
"id": "GHSA-68j8-fp38-p48q",
"modified": "2024-09-20T14:52:32Z",
"published": "2024-09-19T14:49:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/gematik/app-referencevalidator/security/advisories/GHSA-68j8-fp38-p48q"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46984"
},
{
"type": "WEB",
"url": "https://github.com/gematik/app-referencevalidator/commit/d6d27613fab7a8dd08534946f29e0c51f319cad6"
},
{
"type": "WEB",
"url": "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#transformerfactory"
},
{
"type": "PACKAGE",
"url": "https://github.com/gematik/app-referencevalidator"
},
{
"type": "WEB",
"url": "https://github.com/gematik/app-referencevalidator/releases/tag/2.5.1"
},
{
"type": "WEB",
"url": "https://owasp.org/www-community/attacks/Server_Side_Request_Forgery"
},
{
"type": "WEB",
"url": "https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)"
},
{
"type": "WEB",
"url": "https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)#"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Gematik Referenzvalidator has an XXE vulnerability that can lead to a Server Side Request Forgery attack"
}
GHSA-6978-8W7H-MG7H
Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0.0.0 through V9.0.0.10, and WebSphere Message Broker V8.0.0.0 through V8.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to consume memory resources. IBM X-Force ID: 149639.
{
"affected": [],
"aliases": [
"CVE-2018-1801"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-04T21:29:00Z",
"severity": "MODERATE"
},
"details": "IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0.0.0 through V9.0.0.10, and WebSphere Message Broker V8.0.0.0 through V8.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to consume memory resources. IBM X-Force ID: 149639.",
"id": "GHSA-6978-8w7h-mg7h",
"modified": "2022-05-13T01:32:37Z",
"published": "2022-05-13T01:32:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1801"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/149639"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10795780"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-69CM-22PH-XRR5
Vulnerability from github – Published: 2022-05-24 16:53 – Updated: 2024-04-04 01:39A denial of service vulnerability exists when the XmlLite runtime (XmlLite.dll) improperly parses XML input, aka 'XmlLite Runtime Denial of Service Vulnerability'.
{
"affected": [],
"aliases": [
"CVE-2019-1187"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-14T21:15:00Z",
"severity": "HIGH"
},
"details": "A denial of service vulnerability exists when the XmlLite runtime (XmlLite.dll) improperly parses XML input, aka \u0027XmlLite Runtime Denial of Service Vulnerability\u0027.",
"id": "GHSA-69cm-22ph-xrr5",
"modified": "2024-04-04T01:39:20Z",
"published": "2022-05-24T16:53:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1187"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1187"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-69CW-Q85Q-XVFH
Vulnerability from github – Published: 2022-05-24 19:11 – Updated: 2022-05-24 19:11The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).
{
"affected": [],
"aliases": [
"CVE-2021-38584"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-11T23:15:00Z",
"severity": "HIGH"
},
"details": "The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).",
"id": "GHSA-69cw-q85q-xvfh",
"modified": "2022-05-24T19:11:00Z",
"published": "2022-05-24T19:11:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38584"
},
{
"type": "WEB",
"url": "https://docs.cpanel.net/changelogs/98-change-log"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.