Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1745 vulnerabilities reference this CWE, most recent first.
GHSA-XQ76-5H8Q-6J3H
Vulnerability from github – Published: 2022-05-24 17:27 – Updated: 2022-12-06 21:30
VLAI
Details
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2020-24379"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-09T19:15:00Z",
"severity": "MODERATE"
},
"details": "WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.",
"id": "GHSA-xq76-5h8q-6j3h",
"modified": "2022-12-06T21:30:44Z",
"published": "2022-05-24T17:27:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24379"
},
{
"type": "WEB",
"url": "https://github.com/erlyaws/yaws/commits/master"
},
{
"type": "WEB",
"url": "https://github.com/vulnbe/poc-yaws-dav-xxe"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00022.html"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/159106/Yaws-2.0.7-XML-Injection-Command-Injection.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4569-1"
},
{
"type": "WEB",
"url": "https://vuln.be/post/yaws-xxe-and-shell-injections"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4773"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XQCP-X2J9-XJ7C
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-05-24 19:10
VLAI
Details
XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime Fabric, Pivotal Cloud Foundry, Private Cloud Edition, and on-premise customers.
{
"affected": [],
"aliases": [
"CVE-2021-1630"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-05T21:15:00Z",
"severity": "HIGH"
},
"details": "XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime Fabric, Pivotal Cloud Foundry, Private Cloud Edition, and on-premise customers.",
"id": "GHSA-xqcp-x2j9-xj7c",
"modified": "2022-05-24T19:10:08Z",
"published": "2022-05-24T19:10:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1630"
},
{
"type": "WEB",
"url": "https://help.salesforce.com/articleView?id=000362693\u0026type=1\u0026mode=1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XRH2-C3RM-35JR
Vulnerability from github – Published: 2022-05-24 22:01 – Updated: 2022-11-22 18:45
VLAI
Summary
HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference
Details
HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.hornetq.rest:hornetq-rest"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.0.Beta1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-3599"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-22T18:45:47Z",
"nvd_published_at": "2019-11-12T14:15:00Z",
"severity": "MODERATE"
},
"details": "HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy.",
"id": "GHSA-xrh2-c3rm-35jr",
"modified": "2022-11-22T18:45:47Z",
"published": "2022-05-24T22:01:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3599"
},
{
"type": "WEB",
"url": "https://github.com/hornetq/hornetq/commit/b3a63576371828d5f8e64ba7ccbcecb1da8111d2"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2014-3599"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3599"
},
{
"type": "PACKAGE",
"url": "https://github.com/hornetq/hornetq"
},
{
"type": "WEB",
"url": "https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3599.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference"
}
GHSA-XRHW-GPGR-R7CM
Vulnerability from github – Published: 2022-05-24 19:05 – Updated: 2022-05-24 19:05
VLAI
Details
IBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 192956.
{
"affected": [],
"aliases": [
"CVE-2020-5003"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-11T15:15:00Z",
"severity": "CRITICAL"
},
"details": "IBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 192956.",
"id": "GHSA-xrhw-gpgr-r7cm",
"modified": "2022-05-24T19:05:11Z",
"published": "2022-05-24T19:05:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5003"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/192956"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6462861"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XV2G-H4P5-M8RQ
Vulnerability from github – Published: 2022-05-14 01:15 – Updated: 2022-05-14 01:15
VLAI
Details
Windows System Information Console in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability improperly parses XML input containing a reference to an external entity, aka "Windows System Information Console Information Disclosure Vulnerability".
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-8557"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-11T21:29:00Z",
"severity": "MODERATE"
},
"details": "Windows System Information Console in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability improperly parses XML input containing a reference to an external entity, aka \"Windows System Information Console Information Disclosure Vulnerability\".",
"id": "GHSA-xv2g-h4p5-m8rq",
"modified": "2022-05-14T01:15:21Z",
"published": "2022-05-14T01:15:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8557"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8557"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99387"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99398"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038855"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XVHF-Q744-5XM8
Vulnerability from github – Published: 2022-05-24 17:08 – Updated: 2023-01-14 05:26
VLAI
Summary
XXE vulnerability in NUnit Plugin
Details
NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.
This allows a user able to control the input files for its post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks.
NUnit Plugin 0.26 disables external entity processing for its XML parser.
Severity
7.6 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:nunit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.26"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2115"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-14T05:26:14Z",
"nvd_published_at": "2020-02-12T15:15:00Z",
"severity": "HIGH"
},
"details": "NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows a user able to control the input files for its post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks.\n\nNUnit Plugin 0.26 disables external entity processing for its XML parser.",
"id": "GHSA-xvhf-q744-5xm8",
"modified": "2023-01-14T05:26:14Z",
"published": "2022-05-24T17:08:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2115"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/nunit-plugin/commit/8f0b6a7b6a927c4b7003fdcd76862a3348b8205a"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/nunit-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1752"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/02/12/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in NUnit Plugin"
}
GHSA-XVM2-9XVC-HX7F
Vulnerability from github – Published: 2022-03-02 21:30 – Updated: 2022-03-10 15:48
VLAI
Summary
Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer
Details
Impact
Prior to xlsx-streamer 2.1.0, the XML parser that was used did not apply all the necessary settings to prevent XML Entity Expansion issues.
Patches
Upgrade to version 2.1.0.
Workarounds
No known workaround.
References
https://github.com/monitorjbl/excel-streaming-reader/commit/0749c7b9709db078ccdeada16d46a34bc2910c73
For more information
If you have any questions or comments about this advisory: * Open an issue in monitorjbl/excel-streaming-reader
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.monitorjbl:xlsx-streamer"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-23640"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-02T21:30:54Z",
"nvd_published_at": "2022-03-02T20:15:00Z",
"severity": "CRITICAL"
},
"details": "### Impact\nPrior to xlsx-streamer 2.1.0, the XML parser that was used did not apply all the necessary settings to prevent XML Entity Expansion issues.\n\n### Patches\nUpgrade to version 2.1.0.\n\n### Workarounds\nNo known workaround.\n\n### References\nhttps://github.com/monitorjbl/excel-streaming-reader/commit/0749c7b9709db078ccdeada16d46a34bc2910c73\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [monitorjbl/excel-streaming-reader](https://github.com/monitorjbl/excel-streaming-reader)\n\n",
"id": "GHSA-xvm2-9xvc-hx7f",
"modified": "2022-03-10T15:48:44Z",
"published": "2022-03-02T21:30:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/monitorjbl/excel-streaming-reader/security/advisories/GHSA-xvm2-9xvc-hx7f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23640"
},
{
"type": "WEB",
"url": "https://github.com/monitorjbl/excel-streaming-reader/commit/0749c7b9709db078ccdeada16d46a34bc2910c73"
},
{
"type": "WEB",
"url": "https://github.com/monitorjbl/excel-streaming-reader"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer"
}
GHSA-XVV2-CW9Q-2M9R
Vulnerability from github – Published: 2022-07-20 00:00 – Updated: 2022-07-28 00:00
VLAI
Details
Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-34001"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-19T17:15:00Z",
"severity": "MODERATE"
},
"details": "Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously.",
"id": "GHSA-xvv2-cw9q-2m9r",
"modified": "2022-07-28T00:00:43Z",
"published": "2022-07-20T00:00:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34001"
},
{
"type": "WEB",
"url": "https://prisminfosec.com/cve-2022-34001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XVW8-MQG6-CCHX
Vulnerability from github – Published: 2025-03-07 18:31 – Updated: 2025-03-07 18:31
VLAI
Details
IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2025-0162"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-07T17:15:21Z",
"severity": "HIGH"
},
"details": "IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.",
"id": "GHSA-xvw8-mqg6-cchx",
"modified": "2025-03-07T18:31:06Z",
"published": "2025-03-07T18:31:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0162"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7185096"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XW5H-CMH3-8J6J
Vulnerability from github – Published: 2026-06-12 12:31 – Updated: 2026-07-10 12:31
VLAI
Details
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-49875"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-12T10:16:22Z",
"severity": "CRITICAL"
},
"details": "Apache CXF\u0027s EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) \nexternal entity resolution.\u00a0Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.",
"id": "GHSA-xw5h-cmh3-8j6j",
"modified": "2026-07-10T12:31:37Z",
"published": "2026-06-12T12:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49875"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36839"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:37390"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-49875"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488309"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/3kb9w5bg90xcp06fccoz9k3gpsvyy79o"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49875.json"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/06/11/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.