Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1699 vulnerabilities reference this CWE, most recent first.
GHSA-8H9C-R582-MGGC
Vulnerability from github – Published: 2023-03-07 20:41 – Updated: 2024-10-07 21:17
VLAI
Summary
OWSLib vulnerable to XML External Entity (XXE) Injection
Details
Impact
OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution for lxml, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase.
Patches
- Use only lxml for XML handling, adding
resolve_entities=Falsetolxml's parser: https://github.com/geopython/OWSLib/pull/863
Workarounds
patch_well_known_namespaces(etree)
etree.set_default_parser(
parser=etree.XMLParser(resolve_entities=False)
)
References
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "OWSLib"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.28.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-27476"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-07T20:41:36Z",
"nvd_published_at": "2023-03-08T00:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nOWSLib\u0027s XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution for `lxml`, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase.\n\n### Patches\n\n- Use only lxml for XML handling, adding `resolve_entities=False` to `lxml`\u0027s parser: https://github.com/geopython/OWSLib/pull/863\n\n### Workarounds\n\n```python\npatch_well_known_namespaces(etree)\netree.set_default_parser(\n parser=etree.XMLParser(resolve_entities=False)\n)\n```\n\n### References\n\n- [`GHSL-2022-131`](https://securitylab.github.com/advisories/GHSL-2022-131_OWSLib/)\n",
"id": "GHSA-8h9c-r582-mggc",
"modified": "2024-10-07T21:17:55Z",
"published": "2023-03-07T20:41:36Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/geopython/OWSLib/security/advisories/GHSA-8h9c-r582-mggc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27476"
},
{
"type": "WEB",
"url": "https://github.com/geopython/OWSLib/pull/863"
},
{
"type": "WEB",
"url": "https://github.com/geopython/OWSLib/pull/863/commits/b92687702be9576c0681bb11cad21eb631b9122f"
},
{
"type": "PACKAGE",
"url": "https://github.com/geopython/OWSLib"
},
{
"type": "WEB",
"url": "https://github.com/geopython/OWSLib/releases/tag/0.28.1"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/owslib/PYSEC-2023-86.yaml"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00032.html"
},
{
"type": "ADVISORY",
"url": "https://securitylab.github.com/advisories/GHSL-2022-131_owslib"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5426"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OWSLib vulnerable to XML External Entity (XXE) Injection"
}
GHSA-8HF8-CHVW-73M9
Vulnerability from github – Published: 2022-05-14 01:20 – Updated: 2022-05-14 01:20
VLAI
Details
FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim's machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-1000069"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-13T15:29:00Z",
"severity": "MODERATE"
},
"details": "FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim\u0027s machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+.",
"id": "GHSA-8hf8-chvw-73m9",
"modified": "2022-05-14T01:20:28Z",
"published": "2022-05-14T01:20:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000069"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00019.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4175"
},
{
"type": "WEB",
"url": "https://www.freeplane.org/wiki/index.php/XML_External_Entity_vulnerability_in_map_parser"
},
{
"type": "WEB",
"url": "https://www.youtube.com/watch?v=7IXtiTNilAI"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8HP7-P44F-W939
Vulnerability from github – Published: 2024-05-01 18:30 – Updated: 2024-05-01 18:30
VLAI
Details
The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the disclosure of sensitive information.
This issue affects GMS: 9.3.4 and earlier versions.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2024-29010"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-01T18:15:17Z",
"severity": "HIGH"
},
"details": "The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the disclosure of sensitive information.\n\nThis issue affects GMS: 9.3.4 and earlier versions.\n\n",
"id": "GHSA-8hp7-p44f-w939",
"modified": "2024-05-01T18:30:42Z",
"published": "2024-05-01T18:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29010"
},
{
"type": "WEB",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0007"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8HRG-9J2R-PWQR
Vulnerability from github – Published: 2022-05-13 01:54 – Updated: 2022-05-13 01:54
VLAI
Details
LatexDraw version <=4.0 contains a XML External Entity (XXE) vulnerability in SVG parsing functionality that can result in disclosure of data, server side request forgery, port scanning, possible rce. This attack appear to be exploitable via Specially crafted SVG file.
Severity
9.6 (Critical)
{
"affected": [],
"aliases": [
"CVE-2018-1000639"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-20T19:31:00Z",
"severity": "CRITICAL"
},
"details": "LatexDraw version \u003c=4.0 contains a XML External Entity (XXE) vulnerability in SVG parsing functionality that can result in disclosure of data, server side request forgery, port scanning, possible rce. This attack appear to be exploitable via Specially crafted SVG file.",
"id": "GHSA-8hrg-9j2r-pwqr",
"modified": "2022-05-13T01:54:07Z",
"published": "2022-05-13T01:54:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000639"
},
{
"type": "WEB",
"url": "https://github.com/arnobl/latexdraw/issues/10"
},
{
"type": "WEB",
"url": "https://0dd.zone/2018/08/05/LatexDraw-XXE"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8HW9-8JV7-793R
Vulnerability from github – Published: 2022-05-14 01:22 – Updated: 2022-05-14 01:22
VLAI
Details
An arbitrary command execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2017-5828"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-15T22:29:00Z",
"severity": "HIGH"
},
"details": "An arbitrary command execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.",
"id": "GHSA-8hw9-8jv7-793r",
"modified": "2022-05-14T01:22:54Z",
"published": "2022-05-14T01:22:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5828"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03730en_us"
},
{
"type": "WEB",
"url": "http://www.arubanetworks.com/assets/alert/HPESBHF03730.txt"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98722"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8J88-2HFC-5RF3
Vulnerability from github – Published: 2023-04-02 21:30 – Updated: 2023-04-10 16:30
VLAI
Summary
Jenkins Visual Studio Code Metrics Plugin vulnerable to XML external entity (XXE) attacks
Details
Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers able to control VS Code Metrics File contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Severity
7.1 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:vs-code-metrics"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-28681"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-04-03T22:53:56Z",
"nvd_published_at": "2023-04-02T21:15:00Z",
"severity": "HIGH"
},
"details": "Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers able to control VS Code Metrics File contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.",
"id": "GHSA-8j88-2hfc-5rf3",
"modified": "2023-04-10T16:30:42Z",
"published": "2023-04-02T21:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28681"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/vs-code-metrics-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2926"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Visual Studio Code Metrics Plugin vulnerable to XML external entity (XXE) attacks"
}
GHSA-8J9H-QGQG-VVWQ
Vulnerability from github – Published: 2022-05-13 01:33 – Updated: 2022-05-13 01:33
VLAI
Details
In WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior when parsing project files, the XMLParser that ships with Wecon PIStudio is vulnerable to a XML external entity injection attack, which may allow sensitive information disclosure.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-17889"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-10-08T12:29:00Z",
"severity": "MODERATE"
},
"details": "In WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior when parsing project files, the XMLParser that ships with Wecon PIStudio is vulnerable to a XML external entity injection attack, which may allow sensitive information disclosure.",
"id": "GHSA-8j9h-qgqg-vvwq",
"modified": "2022-05-13T01:33:48Z",
"published": "2022-05-13T01:33:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17889"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8J9X-7HF9-69WQ
Vulnerability from github – Published: 2022-05-14 01:11 – Updated: 2022-05-14 01:11
VLAI
Details
XXE issue in Airsonic before 10.1.2 during parse.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2018-20222"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-04-04T16:29:00Z",
"severity": "CRITICAL"
},
"details": "XXE issue in Airsonic before 10.1.2 during parse.",
"id": "GHSA-8j9x-7hf9-69wq",
"modified": "2022-05-14T01:11:29Z",
"published": "2022-05-14T01:11:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20222"
},
{
"type": "WEB",
"url": "https://github.com/airsonic/airsonic/blob/master/CHANGELOG.md"
},
{
"type": "WEB",
"url": "https://github.com/airsonic/airsonic/releases/tag/v10.2.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8JFP-988R-JM7R
Vulnerability from github – Published: 2022-05-24 16:55 – Updated: 2024-04-04 01:55
VLAI
Details
Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager (DSM).
Severity
4.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2019-9488"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-11T18:15:00Z",
"severity": "MODERATE"
},
"details": "Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager (DSM).",
"id": "GHSA-8jfp-988r-jm7r",
"modified": "2024-04-04T01:55:20Z",
"published": "2022-05-24T16:55:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9488"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/solution/1122900"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8MJ2-X5QQ-7M6C
Vulnerability from github – Published: 2024-10-16 18:31 – Updated: 2024-10-21 15:32
VLAI
Details
Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-4184"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-16T17:15:17Z",
"severity": "MODERATE"
},
"details": "Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.",
"id": "GHSA-8mj2-x5qq-7m6c",
"modified": "2024-10-21T15:32:26Z",
"published": "2024-10-16T18:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4184"
},
{
"type": "WEB",
"url": "https://portal.microfocus.com/s/article/KM000033540?language=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:D/RE:L/U:Green",
"type": "CVSS_V4"
}
]
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.