CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1705 vulnerabilities reference this CWE, most recent first.
GHSA-93X2-2W8G-55M7
Vulnerability from github – Published: 2022-05-14 02:47 – Updated: 2025-04-20 03:44XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.
{
"affected": [],
"aliases": [
"CVE-2015-7241"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-06T21:29:00Z",
"severity": "CRITICAL"
},
"details": "XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.",
"id": "GHSA-93x2-2w8g-55m7",
"modified": "2025-04-20T03:44:22Z",
"published": "2022-05-14T02:47:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7241"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/38261"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/133627/SAP-Netweaver-XML-External-Entity-Injection.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/536504/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/76809"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-94CH-W8WC-29RX
Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 152534.
{
"affected": [],
"aliases": [
"CVE-2018-1905"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-26T16:29:00Z",
"severity": "HIGH"
},
"details": "IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 152534.",
"id": "GHSA-94ch-w8wc-29rx",
"modified": "2022-05-13T01:32:31Z",
"published": "2022-05-13T01:32:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1905"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152534"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10738721"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106030"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-9563-9277-F9W9
Vulnerability from github – Published: 2022-05-14 01:14 – Updated: 2022-05-14 01:14The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. This allowed malicious oauth application linked applications to probe internal network resources by requesting internal locations, read the contents of files and also cause an out of memory exception affecting availability via an XML External Entity vulnerability.
{
"affected": [],
"aliases": [
"CVE-2017-18111"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-29T14:29:00Z",
"severity": "HIGH"
},
"details": "The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. This allowed malicious oauth application linked applications to probe internal network resources by requesting internal locations, read the contents of files and also cause an out of memory exception affecting availability via an XML External Entity vulnerability.",
"id": "GHSA-9563-9277-f9w9",
"modified": "2022-05-14T01:14:26Z",
"published": "2022-05-14T01:14:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18111"
},
{
"type": "WEB",
"url": "https://ecosystem.atlassian.net/browse/APL-1338"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-95HQ-2W8Q-XW2V
Vulnerability from github – Published: 2022-05-25 00:00 – Updated: 2022-06-09 00:00An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker can send a request crafted with an XXE payload to invoke a malicious DTD hosted on a system that they control. This results in reading local files that the application has access to.
{
"affected": [],
"aliases": [
"CVE-2022-31261"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-24T15:15:00Z",
"severity": "HIGH"
},
"details": "An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker can send a request crafted with an XXE payload to invoke a malicious DTD hosted on a system that they control. This results in reading local files that the application has access to.",
"id": "GHSA-95hq-2w8q-xw2v",
"modified": "2022-06-09T00:00:19Z",
"published": "2022-05-25T00:00:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31261"
},
{
"type": "WEB",
"url": "https://docs.morpheusdata.com/en/5.4.4/release_notes/current.html"
},
{
"type": "WEB",
"url": "https://support.morpheusdata.com/s/?language=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-965X-72V5-49V5
Vulnerability from github – Published: 2022-11-16 19:00 – Updated: 2022-11-18 06:30An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.
{
"affected": [],
"aliases": [
"CVE-2022-3980"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-16T13:15:00Z",
"severity": "CRITICAL"
},
"details": "An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.",
"id": "GHSA-965x-72v5-49v5",
"modified": "2022-11-18T06:30:35Z",
"published": "2022-11-16T19:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3980"
},
{
"type": "WEB",
"url": "https://www.sophos.com/en-us/security-advisories/sophos-sa-20221116-smc-xee"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-96J8-8455-Q77X
Vulnerability from github – Published: 2025-09-09 15:31 – Updated: 2025-09-09 15:31A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is considered end-of-life as of December 2023. Users are advised to upgrade to TecCom Connect 5.
{
"affected": [],
"aliases": [
"CVE-2025-10183"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-09T15:15:32Z",
"severity": "CRITICAL"
},
"details": "A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is considered end-of-life as of December 2023. Users are advised to upgrade to TecCom Connect 5.",
"id": "GHSA-96j8-8455-q77x",
"modified": "2025-09-09T15:31:19Z",
"published": "2025-09-09T15:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10183"
},
{
"type": "WEB",
"url": "https://blog.blacklanternsecurity.com/p/teccom-tecconnect-41-xml-external"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-975R-CFGJ-8MHF
Vulnerability from github – Published: 2026-02-11 21:30 – Updated: 2026-02-11 21:30MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that references external entities to retrieve sensitive system configuration information.
{
"affected": [],
"aliases": [
"CVE-2020-37192"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-11T21:16:13Z",
"severity": "MODERATE"
},
"details": "MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the \u0027Favorites\u0027 tab by injecting a malicious XML file that references external entities to retrieve sensitive system configuration information.",
"id": "GHSA-975r-cfgj-8mhf",
"modified": "2026-02-11T21:30:41Z",
"published": "2026-02-11T21:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37192"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/47896"
},
{
"type": "WEB",
"url": "https://www.top-password.com"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/msn-password-recovery-xml-external-entity-injection"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-97MP-43RR-5RCX
Vulnerability from github – Published: 2023-10-23 18:30 – Updated: 2024-04-04 08:53Dell Unity prior to 5.3 contains an XML External Entity injection vulnerability. An XXE attack could potentially exploit this vulnerability disclosing local files in the file system.
{
"affected": [],
"aliases": [
"CVE-2023-43067"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-23T16:15:09Z",
"severity": "MODERATE"
},
"details": "\nDell Unity prior to 5.3 contains an XML External Entity injection vulnerability. An XXE attack could potentially exploit this vulnerability disclosing local files in the file system.\n\n",
"id": "GHSA-97mp-43rr-5rcx",
"modified": "2024-04-04T08:53:16Z",
"published": "2023-10-23T18:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43067"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9882-28WJ-G67P
Vulnerability from github – Published: 2022-05-24 17:09 – Updated: 2024-03-21 03:33An issue was discovered in SmartClient 12.0. Unauthenticated exploitation of blind XXE can occur in the downloadWSDL feature by sending a POST request to /tools/developerConsoleOperations.jsp with a valid payload in the _transaction parameter.
{
"affected": [],
"aliases": [
"CVE-2020-9352"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-23T02:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in SmartClient 12.0. Unauthenticated exploitation of blind XXE can occur in the downloadWSDL feature by sending a POST request to /tools/developerConsoleOperations.jsp with a valid payload in the _transaction parameter.",
"id": "GHSA-9882-28wj-g67p",
"modified": "2024-03-21T03:33:54Z",
"published": "2022-05-24T17:09:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9352"
},
{
"type": "WEB",
"url": "https://blog.certimetergroup.com/it/articolo/security/smartclient-v12-xml-external-entity--cve-2020-9352"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2020/Feb/18"
},
{
"type": "WEB",
"url": "https://www-demos.smartclient.com/smartclient-12.0/isomorphic/system/reference/?id=group..toolsDeployment"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-98G3-884P-C9Q5
Vulnerability from github – Published: 2022-05-24 17:47 – Updated: 2022-05-24 17:47In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Service Repository JAVA Mappings), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, SAP recommends to refer this note.
{
"affected": [],
"aliases": [
"CVE-2021-27604"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-14T15:15:00Z",
"severity": "MODERATE"
},
"details": "In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Service Repository JAVA Mappings), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, SAP recommends to refer this note.",
"id": "GHSA-98g3-884p-c9q5",
"modified": "2022-05-24T17:47:36Z",
"published": "2022-05-24T17:47:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27604"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/3036436"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.