CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1694 vulnerabilities reference this CWE, most recent first.
GHSA-J3H2-8MF8-J5R2
Vulnerability from github – Published: 2022-07-15 18:12 – Updated: 2022-07-29 13:11In versions prior to 3.3.2, Hudson exhibits a flaw in its XML API processing that can allow access to potentially sensitive information on the filesystem of the Hudson master server.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jvnet.hudson.main:hudson-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-8031"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-15T18:12:47Z",
"nvd_published_at": "2022-07-18T21:15:00Z",
"severity": "CRITICAL"
},
"details": "In versions prior to 3.3.2, Hudson exhibits a flaw in its XML API processing that can allow access to potentially sensitive information on the filesystem of the Hudson master server.",
"id": "GHSA-j3h2-8mf8-j5r2",
"modified": "2022-07-29T13:11:52Z",
"published": "2022-07-15T18:12:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8031"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-j3h2-8mf8-j5r2"
},
{
"type": "PACKAGE",
"url": "https://github.com/hudson/hudson-2.x"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGJVNETHUDSONMAIN-31221"
},
{
"type": "WEB",
"url": "https://wiki.eclipse.org/Hudson-ci/alerts/CVE-2015-8031"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Hudson XML API susceptible to External Entity Injection Vunerability prior to v3.3.2"
}
GHSA-J3Q2-JVCH-J544
Vulnerability from github – Published: 2024-05-03 03:31 – Updated: 2024-05-03 03:31Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of XML files. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the current process. Was ZDI-CAN-18644.
{
"affected": [],
"aliases": [
"CVE-2023-51605"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T03:16:22Z",
"severity": "MODERATE"
},
"details": "Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XML files. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the current process. Was ZDI-CAN-18644.",
"id": "GHSA-j3q2-jvch-j544",
"modified": "2024-05-03T03:31:08Z",
"published": "2024-05-03T03:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51605"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1854"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J424-2GW5-5MRV
Vulnerability from github – Published: 2024-05-14 18:31 – Updated: 2024-05-14 18:31Microsoft SharePoint Server Information Disclosure Vulnerability
{
"affected": [],
"aliases": [
"CVE-2024-30043"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T17:17:15Z",
"severity": "MODERATE"
},
"details": "Microsoft SharePoint Server Information Disclosure Vulnerability",
"id": "GHSA-j424-2gw5-5mrv",
"modified": "2024-05-14T18:31:04Z",
"published": "2024-05-14T18:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30043"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30043"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J48H-6X68-4FC5
Vulnerability from github – Published: 2024-01-24 03:31 – Updated: 2025-06-20 21:31Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
{
"affected": [],
"aliases": [
"CVE-2024-21765"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-24T02:15:07Z",
"severity": "MODERATE"
},
"details": "Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.",
"id": "GHSA-j48h-6x68-4fc5",
"modified": "2025-06-20T21:31:52Z",
"published": "2024-01-24T03:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21765"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN77736613"
},
{
"type": "WEB",
"url": "https://www.ysk.nilim.go.jp/cals"
},
{
"type": "WEB",
"url": "http://www.cals-ed.go.jp/checksys-release-20231130"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J55R-96HC-W4X5
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-05-24 19:03IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 172533.
{
"affected": [],
"aliases": [
"CVE-2019-4730"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-01T14:15:00Z",
"severity": "HIGH"
},
"details": "IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 172533.",
"id": "GHSA-j55r-96hc-w4x5",
"modified": "2022-05-24T19:03:47Z",
"published": "2022-05-24T19:03:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4730"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/172533"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210622-0004"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6451705"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J5G2-Q29X-CW3H
Vulnerability from github – Published: 2024-12-02 20:00 – Updated: 2024-12-04 16:13Withdrawn Advisory
This advisory has been withdrawn because the vulnerability affects users of the SimpleSAMLphp tarball, not the SimpleSAMLphp Composer package. The underlying information about CVE-2024-52596 is still valid.
Original Description
Summary
When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE.
Mitigation:
Remove the LIBXML_DTDLOAD | LIBXML_DTDATTR options from $options is in: https://github.com/simplesamlphp/saml2/blob/717c0adc4877ebd58428637e5626345e59fa0109/src/SAML2/DOMDocumentFactory.php#L41
Background / details
To be published on Dec 8th
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "simplesamlphp/simplesamlphp"
},
"ranges": [
{
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "simplesamlphp/simplesamlphp"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "simplesamlphp/simplesamlphp"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "simplesamlphp/simplesamlphp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-02T20:00:29Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Withdrawn Advisory\nThis advisory has been withdrawn because the vulnerability affects users of the SimpleSAMLphp tarball, not the SimpleSAMLphp Composer package. The underlying information about CVE-2024-52596 is still valid.\n\n## Original Description\n\n# Summary\nWhen loading an (untrusted) XML document, for example the SAMLResponse, it\u0027s possible to induce an XXE.\n\n## Mitigation:\n\nRemove the `LIBXML_DTDLOAD | LIBXML_DTDATTR` options from `$options` is in: https://github.com/simplesamlphp/saml2/blob/717c0adc4877ebd58428637e5626345e59fa0109/src/SAML2/DOMDocumentFactory.php#L41\n\n## Background / details\n\nTo be published on Dec 8th",
"id": "GHSA-j5g2-q29x-cw3h",
"modified": "2024-12-04T16:13:50Z",
"published": "2024-12-02T20:00:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-j5g2-q29x-cw3h"
},
{
"type": "WEB",
"url": "https://github.com/simplesamlphp/xml-common/security/advisories/GHSA-2x65-fpch-2fcm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52596"
},
{
"type": "PACKAGE",
"url": "https://github.com/simplesamlphp/simplesamlphp"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "SimpleSAMLphp vulnerable to XXE in parsing SAML messages",
"withdrawn": "2024-12-04T16:13:50Z"
}
GHSA-J629-MR84-X8MF
Vulnerability from github – Published: 2022-05-14 03:41 – Updated: 2022-05-14 03:41Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable.
{
"affected": [],
"aliases": [
"CVE-2018-2392"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-14T12:29:00Z",
"severity": "HIGH"
},
"details": "Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable.",
"id": "GHSA-j629-mr84-x8mf",
"modified": "2022-05-14T03:41:04Z",
"published": "2022-05-14T03:41:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2392"
},
{
"type": "WEB",
"url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2525222"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J673-QXGG-6Q9G
Vulnerability from github – Published: 2022-05-14 03:46 – Updated: 2022-05-14 03:46XML external entity (XXE) vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote authenticated users to cause a denial of service via crafted XML data. IBM X-Force ID: 109693.
{
"affected": [],
"aliases": [
"CVE-2016-0219"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-16T19:29:00Z",
"severity": "MODERATE"
},
"details": "XML external entity (XXE) vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote authenticated users to cause a denial of service via crafted XML data. IBM X-Force ID: 109693.",
"id": "GHSA-j673-qxgg-6q9g",
"modified": "2022-05-14T03:46:15Z",
"published": "2022-05-14T03:46:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0219"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/109693"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21983720"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J68W-PG49-F6VX
Vulnerability from github – Published: 2024-05-30 00:52 – Updated: 2024-05-30 00:52The XMLEncoder component of Symfony 2.0.x fails to disable external entities when parsing XML. In the Symfony2 framework the XML class may be used to deserialize objects or as part of a client/server API. By using external entities it is possible to include arbitrary files from the file system.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/serializer"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-30T00:52:20Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "The XMLEncoder component of Symfony 2.0.x fails to disable external entities when parsing XML. In the Symfony2 framework the XML class may be used to deserialize objects or as part of a client/server API. By using external entities it is possible to include arbitrary files from the file system.",
"id": "GHSA-j68w-pg49-f6vx",
"modified": "2024-05-30T00:52:20Z",
"published": "2024-05-30T00:52:20Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/symfony/serializer/commit/0943a06a663b573d7319fc1acd56d3484eaaa430"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/serializer/2012-02-24.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/symfony/serializer"
},
{
"type": "WEB",
"url": "https://symfony.com/blog/security-release-symfony-2-0-11-released"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Symfony XML decoding attack vector through external entities"
}
GHSA-J69F-FGH5-F7MC
Vulnerability from github – Published: 2022-12-30 12:30 – Updated: 2023-01-10 00:40A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The name of the patch is ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.itextpdf:itext-rups"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-20151"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-10T00:40:37Z",
"nvd_published_at": "2022-12-30T12:15:00Z",
"severity": "CRITICAL"
},
"details": "A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file `src/main/java/com/itextpdf/rups/model/XfaFile.java`. The manipulation leads to xml external entity reference. The name of the patch is ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.",
"id": "GHSA-j69f-fgh5-f7mc",
"modified": "2023-01-10T00:40:37Z",
"published": "2022-12-30T12:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-20151"
},
{
"type": "WEB",
"url": "https://github.com/itext/rups/commit/ac5590925874ef810018a6b60fec216eee54fb32"
},
{
"type": "PACKAGE",
"url": "https://github.com/itext/rups"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.217054"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.217054"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "iText RUPS XML External Entity vulnerability"
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.