Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1699 vulnerabilities reference this CWE, most recent first.
GHSA-8C3X-HQ82-GJCM
Vulnerability from github – Published: 2025-01-24 18:33 – Updated: 2026-01-28 23:21
VLAI
Summary
XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`
Details
Impact
XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where external clients can submit XML.
A previous release provided an incomplete solution revealed by new testing.
Patches
This issue has been patched as of version 1.7.4
Workarounds
None
References
Previous Advisory for Incomplete solution MITRE CWE OWASP XML External Entity Prevention Cheat Sheet
Severity
8.6 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.hl7.fhir.publisher:org.hl7.fhir.publisher.core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-52807"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2025-01-24T18:33:29Z",
"nvd_published_at": "2025-01-24T19:15:12Z",
"severity": "HIGH"
},
"details": "### Impact\nXSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( ]\u003e could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where external clients can submit XML.\n\nA previous release provided an incomplete solution revealed by new testing. \n\n### Patches\nThis issue has been patched as of version 1.7.4\n\n### Workarounds\nNone\n\n### References\n[Previous Advisory for Incomplete solution](https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5)\n[MITRE CWE](https://cwe.mitre.org/data/definitions/611.html)\n[OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#transformerfactory)",
"id": "GHSA-8c3x-hq82-gjcm",
"modified": "2026-01-28T23:21:27Z",
"published": "2025-01-24T18:33:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5"
},
{
"type": "WEB",
"url": "https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-8c3x-hq82-gjcm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52807"
},
{
"type": "WEB",
"url": "https://github.com/HL7/fhir-ig-publisher/commit/3560de2f486d688a3ddcf4aa54d8bdacea380c3d"
},
{
"type": "PACKAGE",
"url": "https://github.com/HL7/fhir-ig-publisher"
},
{
"type": "WEB",
"url": "https://github.com/HL7/fhir-ig-publisher/compare/1.7.3...1.7.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`"
}
GHSA-8CR8-4VFW-MR7H
Vulnerability from github – Published: 2021-04-30 17:30 – Updated: 2022-08-22 19:43
VLAI
Summary
REXML round-trip instability
Details
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "rexml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-28965"
],
"database_specific": {
"cwe_ids": [
"CWE-115",
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-22T16:31:39Z",
"nvd_published_at": "2021-04-21T07:15:00Z",
"severity": "HIGH"
},
"details": "The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing. ",
"id": "GHSA-8cr8-4vfw-mr7h",
"modified": "2022-08-22T19:43:17Z",
"published": "2021-04-30T17:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28965"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/commit/2fe62e29094d95921d7e19abbd2e26b23d78dc5b"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/commit/3c137eb119550874b2b3e27d12b733ca67033377"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/commit/6a250d2cd1194c2be72becbdd9c3e770aa16e752"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/commit/9b311e59ae05749e082eb6bbefa1cb620d1a786e"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/commit/a659c63e37414506dfb0d4655e031bb7a2e73fc8"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/commit/f7bab8937513b1403cea5aff874cbf32fd5e8551"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/commit/f9d88e4948b4a43294c25dc0edb16815bd9d8618"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1104077"
},
{
"type": "PACKAGE",
"url": "https://github.com/ruby/rexml"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2021-28965.yml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT"
},
{
"type": "WEB",
"url": "https://rubygems.org/gems/rexml"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210528-0003"
},
{
"type": "WEB",
"url": "https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "REXML round-trip instability"
}
GHSA-8CXF-788Q-XF3G
Vulnerability from github – Published: 2022-05-13 01:38 – Updated: 2022-05-13 01:38
VLAI
Details
A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file with malicious entries, which could allow the attacker to read and write files and execute remote code within the application. Cisco Bug IDs: CSCvf47946.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2017-12216"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-07T21:29:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file with malicious entries, which could allow the attacker to read and write files and execute remote code within the application. Cisco Bug IDs: CSCvf47946.",
"id": "GHSA-8cxf-788q-xf3g",
"modified": "2022-05-13T01:38:10Z",
"published": "2022-05-13T01:38:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12216"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-socmin"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100664"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039274"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8CXH-WXVQ-9JGW
Vulnerability from github – Published: 2024-07-22 21:30 – Updated: 2024-12-02 18:31
VLAI
Details
Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-40075"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T19:15:02Z",
"severity": "MODERATE"
},
"details": "Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.",
"id": "GHSA-8cxh-wxvq-9jgw",
"modified": "2024-12-02T18:31:54Z",
"published": "2024-07-22T21:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40075"
},
{
"type": "WEB",
"url": "https://gitee.com/Q16G/laravel_bug/blob/master/laravelBug.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-8F5H-G89Q-H3FX
Vulnerability from github – Published: 2022-05-13 01:35 – Updated: 2022-05-13 01:35
VLAI
Details
A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of the XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by injecting a crafted XML file with malicious entries, which could allow the attacker to read and write files. Cisco Bug IDs: CSCvg19341.
Severity
4.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-0100"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-18T06:29:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of the XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by injecting a crafted XML file with malicious entries, which could allow the attacker to read and write files. Cisco Bug IDs: CSCvg19341.",
"id": "GHSA-8f5h-g89q-h3fx",
"modified": "2022-05-13T01:35:49Z",
"published": "2022-05-13T01:35:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0100"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-acpe"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102738"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040246"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8FRX-325F-XVXG
Vulnerability from github – Published: 2024-02-01 18:31 – Updated: 2024-02-01 18:31
VLAI
Details
When SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-1167"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-01T18:15:53Z",
"severity": "MODERATE"
},
"details": "\nWhen SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur.\n\n",
"id": "GHSA-8frx-325f-xvxg",
"modified": "2024-02-01T18:31:08Z",
"published": "2024-02-01T18:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1167"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-016-01"
},
{
"type": "WEB",
"url": "https://www.seweurodrive.com/contact_us/contact_us.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8G38-JGJC-P9JH
Vulnerability from github – Published: 2024-10-14 15:30 – Updated: 2024-12-11 09:32
VLAI
Details
When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE (XML External Entity) attack. Further information on this can be found on the website of the Open Worldwide Application Security Project (OWASP). An attacker could theoretically leverage this by delivering a manipulated PDF file to the target, and depending on the environment, various actions can be executed. These actions include:
- Reading files from the operating system
- Crashing the thread handling the parsing or causing it to enter an infinite loop
- Executing HTTP requests
- Loading additional DTDs or XML files
- Under certain conditions, executing OS commands
Severity
{
"affected": [],
"aliases": [
"CVE-2024-8602"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-14T14:15:12Z",
"severity": "MODERATE"
},
"details": "When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE (XML External Entity) attack. Further information on this can be found on the website of the Open Worldwide Application Security Project (OWASP). An attacker could theoretically leverage this by delivering a manipulated PDF file to the target, and depending on the environment, various actions can be executed. These actions include:\n\n * Reading files from the operating system\n * Crashing the thread handling the parsing or causing it to enter an infinite loop\n * Executing HTTP requests\n * Loading additional DTDs or XML files\n * Under certain conditions, executing OS commands",
"id": "GHSA-8g38-jgjc-p9jh",
"modified": "2024-12-11T09:32:03Z",
"published": "2024-10-14T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8602"
},
{
"type": "WEB",
"url": "https://esteuer.ewv-ete.ch/fileadmin/esta/2024-10-09-update/24_09_esta_newsletter_de.pdf"
},
{
"type": "WEB",
"url": "https://mkiesel.ch/posts/swiss-tax-adventures-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:L/U:Green",
"type": "CVSS_V4"
}
]
}
GHSA-8GF7-W3CP-GFH3
Vulnerability from github – Published: 2022-05-24 19:18 – Updated: 2022-06-21 20:11
VLAI
Summary
Improper Restriction of XML External Entity Reference in Stanford CoreNLP
Details
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
Severity
7.5 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.3.0"
},
"package": {
"ecosystem": "Maven",
"name": "edu.stanford.nlp:stanford-corenlp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-3869"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-21T20:11:57Z",
"nvd_published_at": "2021-10-19T13:15:00Z",
"severity": "HIGH"
},
"details": "corenlp is vulnerable to Improper Restriction of XML External Entity Reference",
"id": "GHSA-8gf7-w3cp-gfh3",
"modified": "2022-06-21T20:11:57Z",
"published": "2022-05-24T19:18:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3869"
},
{
"type": "WEB",
"url": "https://github.com/stanfordnlp/corenlp/commit/5d83f1e8482ca304db8be726cad89554c88f136a"
},
{
"type": "PACKAGE",
"url": "https://github.com/stanfordnlp/CoreNLP"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/2f8baf6c-14b3-420d-8ede-9805797cd324"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference in Stanford CoreNLP"
}
GHSA-8GPX-73GC-WQ7C
Vulnerability from github – Published: 2022-05-24 22:01 – Updated: 2022-05-24 22:01
VLAI
Details
In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to LemMinX) in order to provide language support for XML. This is installed by default.
{
"affected": [],
"aliases": [
"CVE-2021-34436"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-02T21:15:00Z",
"severity": "CRITICAL"
},
"details": "In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to LemMinX) in order to provide language support for XML. This is installed by default.",
"id": "GHSA-8gpx-73gc-wq7c",
"modified": "2022-05-24T22:01:46Z",
"published": "2022-05-24T22:01:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34436"
},
{
"type": "WEB",
"url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=563174"
},
{
"type": "PACKAGE",
"url": "https://github.com/theia-ide/theia-xml-extension"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8H4F-P5HQ-W6GC
Vulnerability from github – Published: 2022-05-14 01:48 – Updated: 2022-05-14 01:48
VLAI
Details
An XML External Entity (XXE) vulnerability exists in iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2018-17411"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-26T22:29:00Z",
"severity": "CRITICAL"
},
"details": "An XML External Entity (XXE) vulnerability exists in iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20.",
"id": "GHSA-8h4f-p5hq-w6gc",
"modified": "2022-05-14T01:48:26Z",
"published": "2022-05-14T01:48:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17411"
},
{
"type": "WEB",
"url": "https://github.com/MrR3boot/CVE-Hunting/blob/master/iWay%20DQS%20XXE.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.