CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1705 vulnerabilities reference this CWE, most recent first.
GHSA-8XMW-6Q27-4H39
Vulnerability from github – Published: 2022-05-14 02:04 – Updated: 2022-05-14 02:04VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) Distributed Switch setup, or (3) Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
{
"affected": [],
"aliases": [
"CVE-2016-7459"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-12-29T09:59:00Z",
"severity": "HIGH"
},
"details": "VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) Distributed Switch setup, or (3) Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"id": "GHSA-8xmw-6q27-4h39",
"modified": "2022-05-14T02:04:18Z",
"published": "2022-05-14T02:04:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7459"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94486"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1037329"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2016-0022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8XV9-QCR9-WW9J
Vulnerability from github – Published: 2020-10-19 21:32 – Updated: 2021-10-04 21:28Impact
Authenticated XML External Entity Processing
Patches
We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin: https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.3.2.0"
},
"package": {
"ecosystem": "Packagist",
"name": "shopware/platform"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.3.2.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.3.2.0"
},
"package": {
"ecosystem": "Packagist",
"name": "shopware/core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.3.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-10-19T21:32:05Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\nAuthenticated XML External Entity Processing\n\n### Patches\nWe recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.\n\nhttps://www.shopware.com/en/download/#shopware-6\n\n### Workarounds\nFor older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:\nhttps://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659\n\n### For more information\nhttps://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020",
"id": "GHSA-8xv9-qcr9-ww9j",
"modified": "2021-10-04T21:28:06Z",
"published": "2020-10-19T21:32:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/shopware/platform/security/advisories/GHSA-8xv9-qcr9-ww9j"
},
{
"type": "PACKAGE",
"url": "https://github.com/shopware/platform"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PHP-SHOPWAREPLATFORM-1019470"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Authenticated XML External Entity Processing"
}
GHSA-8XX8-9G4G-C4Q2
Vulnerability from github – Published: 2022-05-13 01:14 – Updated: 2022-05-13 01:14IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service.
{
"affected": [],
"aliases": [
"CVE-2016-2908"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-01T20:59:00Z",
"severity": "CRITICAL"
},
"details": "IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service.",
"id": "GHSA-8xx8-9g4g-c4q2",
"modified": "2022-05-13T01:14:03Z",
"published": "2022-05-13T01:14:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2908"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg21995531"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/95295"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038506"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8XXP-2WXG-R73W
Vulnerability from github – Published: 2022-05-24 17:38 – Updated: 2022-05-24 17:38SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privileges to parse malicious XML files which could result in XXE-based attacks in applications that accept attacker-controlled XML configuration files. This occurs as logging service does not disable XML external entities when parsing configuration files and a successful exploit would result in limited impact on integrity and availability of the application.
{
"affected": [],
"aliases": [
"CVE-2021-21470"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-12T15:15:00Z",
"severity": "MODERATE"
},
"details": "SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privileges to parse malicious XML files which could result in XXE-based attacks in applications that accept attacker-controlled XML configuration files. This occurs as logging service does not disable XML external entities when parsing configuration files and a successful exploit would result in limited impact on integrity and availability of the application.",
"id": "GHSA-8xxp-2wxg-r73w",
"modified": "2022-05-24T17:38:55Z",
"published": "2022-05-24T17:38:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21470"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/3000291"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-927C-C24Q-W7GX
Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2022-12-03 00:30IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 164555.
{
"affected": [],
"aliases": [
"CVE-2019-4513"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-26T15:15:00Z",
"severity": "HIGH"
},
"details": "IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 164555.",
"id": "GHSA-927c-c24q-w7gx",
"modified": "2022-12-03T00:30:20Z",
"published": "2022-05-24T16:54:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4513"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/164555"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10996716"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-92H7-3MPG-68JH
Vulnerability from github – Published: 2022-05-24 19:14 – Updated: 2022-05-24 19:14Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possible to inject malicious XML data through several access points.
{
"affected": [],
"aliases": [
"CVE-2021-30137"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-15T13:15:00Z",
"severity": "HIGH"
},
"details": "Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possible to inject malicious XML data through several access points.",
"id": "GHSA-92h7-3mpg-68jh",
"modified": "2022-05-24T19:14:40Z",
"published": "2022-05-24T19:14:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30137"
},
{
"type": "WEB",
"url": "https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2021-30137.pdf"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-92J5-798V-G55R
Vulnerability from github – Published: 2022-05-13 01:26 – Updated: 2022-05-13 01:26Zimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks.
{
"affected": [],
"aliases": [
"CVE-2016-9924"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-29T14:59:00Z",
"severity": "CRITICAL"
},
"details": "Zimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks.",
"id": "GHSA-92j5-798v-g55r",
"modified": "2022-05-13T01:26:00Z",
"published": "2022-05-13T01:26:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9924"
},
{
"type": "WEB",
"url": "https://wiki.zimbra.com/wiki/Security_Center"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97121"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-92WJ-X78C-M4FX
Vulnerability from github – Published: 2019-01-07 19:14 – Updated: 2023-09-11 22:40Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.karaf.specs:org.apache.karaf.specs.java.xml"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.karaf.specs:org.apache.karaf.specs.java.xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-11788"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:27:16Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Apache Karaf provides a features deployer, which allows users to \"hot deploy\" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn\u0027t contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.",
"id": "GHSA-92wj-x78c-m4fx",
"modified": "2023-09-11T22:40:24Z",
"published": "2019-01-07T19:14:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11788"
},
{
"type": "WEB",
"url": "https://github.com/apache/karaf/commit/0c36c50bc158739c8fc8543122a6740c54adafca"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/karaf"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200227101219/https://www.securityfocus.com/bid/106479"
},
{
"type": "WEB",
"url": "http://karaf.apache.org/security/cve-2018-11788.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XML External Entity Reference in Apache Karaf"
}
GHSA-93GM-2PXG-46P3
Vulnerability from github – Published: 2023-01-09 12:30 – Updated: 2023-01-13 00:30A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The manipulation leads to xml external entity reference. The name of the patch is 31d442b9fb1d518128fd18f6e4d54e06c3d67793. It is recommended to apply a patch to fix this issue. VDB-217666 is the identifier assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2021-4311"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-09T12:15:00Z",
"severity": "CRITICAL"
},
"details": "A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The manipulation leads to xml external entity reference. The name of the patch is 31d442b9fb1d518128fd18f6e4d54e06c3d67793. It is recommended to apply a patch to fix this issue. VDB-217666 is the identifier assigned to this vulnerability.",
"id": "GHSA-93gm-2pxg-46p3",
"modified": "2023-01-13T00:30:41Z",
"published": "2023-01-09T12:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4311"
},
{
"type": "WEB",
"url": "https://github.com/Talend/tmdm-server-se/pull/1420"
},
{
"type": "WEB",
"url": "https://github.com/Talend/tmdm-server-se/commit/31d442b9fb1d518128fd18f6e4d54e06c3d67793"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.217666"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.217666"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-93HF-XXFJ-6GX3
Vulnerability from github – Published: 2022-05-24 19:14 – Updated: 2022-05-24 19:14XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a local user to initiate high CPU and memory consumption resulting in a Denial of Service attack through carefully editing the EPDeploy.xml file and then executing the setup process.
{
"affected": [],
"aliases": [
"CVE-2021-31842"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-17T14:15:00Z",
"severity": "MODERATE"
},
"details": "XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a local user to initiate high CPU and memory consumption resulting in a Denial of Service attack through carefully editing the EPDeploy.xml file and then executing the setup process.",
"id": "GHSA-93hf-xxfj-6gx3",
"modified": "2022-05-24T19:14:57Z",
"published": "2022-05-24T19:14:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31842"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10367"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.