CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1857 vulnerabilities reference this CWE, most recent first.
GHSA-XH7C-PF93-3V3R
Vulnerability from github – Published: 2024-07-18 18:31 – Updated: 2024-07-18 18:31IBM Engineering Requirements Management DOORS Web Access 9.7.2.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 273335.
{
"affected": [],
"aliases": [
"CVE-2023-50304"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-18T16:15:06Z",
"severity": "HIGH"
},
"details": "IBM Engineering Requirements Management DOORS Web Access 9.7.2.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 273335.",
"id": "GHSA-xh7c-pf93-3v3r",
"modified": "2024-07-18T18:31:42Z",
"published": "2024-07-18T18:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50304"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/273335"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7160471"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XM28-XVQC-GXXG
Vulnerability from github – Published: 2026-10-02 18:27 – Updated: 2026-10-02 18:27Copernik XML Factory through 0.1.1, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory(), or on an XMLReader passed through XmlFactories.harden(). The library's documented guarantee that XInclude resolution stays disabled therefore does not hold on that provider.
An application that parses untrusted XML in this configuration can be made to resolve xi:include references, allowing an attacker to read local files (information disclosure) or, through http hrefs, reach internal network endpoints (SSRF).
All of the following conditions must hold for an application to be affected:
- it obtains a factory from XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory(), or hardens an externally obtained XMLReader with XmlFactories.harden();
- the stock JDK provider is in effect, that is, Apache Xerces is not on the classpath;
- XInclude is enabled, by calling setXIncludeAware(true) or the equivalent reader feature;
- it parses XML from an untrusted source.
The Xerces provider (selected when Xerces is on the classpath) and the Android provider are not affected.
Applications are advised to upgrade to 0.1.2, which fixes the defect. As a workaround add Apache Xerces (xercesImpl) to the classpath so the library selects its unaffected Xerces provider.
Acknowledgements
The maintainer thank the following people for finding, reporting, and helping to remediate this issue:
- Finders: Ta Duc Thien and Duc Anh Nguyen (Danzation)
- Remediation developer: Ta Duc Thien
- Tooling: Claude Code (Anthropic), Claude Opus 4.8
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "eu.copernik:copernik-xml-factory"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-61586"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-02T18:27:17Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Copernik XML Factory through `0.1.1`, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or on an `XMLReader` passed through `XmlFactories.harden()`. The library\u0027s documented guarantee that XInclude resolution stays disabled therefore does not hold on that provider.\n\nAn application that parses untrusted XML in this configuration can be made to resolve `xi:include` references, allowing an attacker to read local files (information disclosure) or, through `http` hrefs, reach internal network endpoints (SSRF).\n\nAll of the following conditions must hold for an application to be affected:\n- it obtains a factory from `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or hardens an externally obtained `XMLReader` with `XmlFactories.harden()`;\n- the stock JDK provider is in effect, that is, Apache Xerces is not on the classpath;\n- XInclude is enabled, by calling `setXIncludeAware(true)` or the equivalent reader feature;\n- it parses XML from an untrusted source.\n\nThe Xerces provider (selected when Xerces is on the classpath) and the Android provider are not affected.\n\nApplications are advised to upgrade to `0.1.2`, which fixes the defect. As a workaround add Apache Xerces (`xercesImpl`) to the classpath so the library selects its unaffected Xerces provider.\n\n### Acknowledgements\n\nThe maintainer thank the following people for finding, reporting, and helping to remediate this issue:\n\n- Finders: Ta Duc Thien and Duc Anh Nguyen (Danzation)\n- Remediation developer: Ta Duc Thien\n- Tooling: Claude Code (Anthropic), Claude Opus 4.8",
"id": "GHSA-xm28-xvqc-gxxg",
"modified": "2026-10-02T18:27:17Z",
"published": "2026-10-02T18:27:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/copernik-eu/copernik-xml-factory/security/advisories/GHSA-xm28-xvqc-gxxg"
},
{
"type": "WEB",
"url": "https://github.com/copernik-eu/copernik-xml-factory/commit/2fa042c44931b0a4ddd585d62b97a8a987efd6c6"
},
{
"type": "WEB",
"url": "https://github.com/copernik-eu/copernik-xml-factory/commit/e5febc6039ed4b0088245acb80ed7d6d6a7f5537"
},
{
"type": "PACKAGE",
"url": "https://github.com/copernik-eu/copernik-xml-factory"
},
{
"type": "WEB",
"url": "https://github.com/copernik-eu/copernik-xml-factory/releases/tag/v0.1.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution"
}
GHSA-XMFF-C8V2-FHFP
Vulnerability from github – Published: 2023-05-18 03:30 – Updated: 2023-05-18 03:30Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery (SSRF) attack through an affected device. To exploit these vulnerabilities, an attacker must have valid Administrator credentials on the affected device. For more information about these vulnerabilities, see the Details section of this advisory.
{
"affected": [],
"aliases": [
"CVE-2023-20173"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-18T03:15:10Z",
"severity": "MODERATE"
},
"details": "Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery (SSRF) attack through an affected device. To exploit these vulnerabilities, an attacker must have valid Administrator credentials on the affected device. For more information about these vulnerabilities, see the Details section of this advisory.",
"id": "GHSA-xmff-c8v2-fhfp",
"modified": "2023-05-18T03:30:21Z",
"published": "2023-05-18T03:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20173"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xxe-inj-696OZTCm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XMVG-W4F9-99R7
Vulnerability from github – Published: 2018-12-20 22:02 – Updated: 2022-09-14 22:23bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the Middle or malicious server.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.bedework.caleng:bw-calendar-engine"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.12.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1000836"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T22:03:50Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "bw-calendar-engine version \u003c= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the Middle or malicious server.",
"id": "GHSA-xmvg-w4f9-99r7",
"modified": "2022-09-14T22:23:07Z",
"published": "2018-12-20T22:02:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000836"
},
{
"type": "WEB",
"url": "https://github.com/Bedework/bw-calendar-engine/issues/3"
},
{
"type": "WEB",
"url": "https://0dd.zone/2018/10/28/bw-calendar-engine-XXE-MitM"
},
{
"type": "PACKAGE",
"url": "https://github.com/Bedework/bw-calendar-engine"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-xmvg-w4f9-99r7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XML External Entity (XXE) vulnerability in bw-calendar-engine"
}
GHSA-XP65-54G6-4JPJ
Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 155265.
{
"affected": [],
"aliases": [
"CVE-2018-2019"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-18T16:29:00Z",
"severity": "HIGH"
},
"details": "IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 155265.",
"id": "GHSA-xp65-54g6-4jpj",
"modified": "2022-05-13T01:32:23Z",
"published": "2022-05-13T01:32:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2019"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/155265"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10794615"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106657"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XP8P-9RQ5-4WGV
Vulnerability from github – Published: 2022-05-17 03:16 – Updated: 2023-08-03 21:53The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendframework"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.4.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendframework"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendframework1"
},
"ranges": [
{
"events": [
{
"introduced": "1.12.0"
},
{
"fixed": "1.12.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendxml"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.0.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendframework"
},
"ranges": [
{
"events": [
{
"introduced": "1.12.0"
},
{
"fixed": "1.12.14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-5161"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-03T21:53:46Z",
"nvd_published_at": "2015-08-25T17:59:00Z",
"severity": "MODERATE"
},
"details": "The `Zend_Xml_Security::scan` in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.",
"id": "GHSA-xp8p-9rq5-4wgv",
"modified": "2023-08-03T21:53:46Z",
"published": "2022-05-17T03:16:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5161"
},
{
"type": "WEB",
"url": "https://github.com/zendframework/zf1/issues/393"
},
{
"type": "WEB",
"url": "https://github.com/zendframework/ZendXml/commit/79f478fa2af85ce1fc18ac132dee5aa714c3b532"
},
{
"type": "WEB",
"url": "https://github.com/zendframework/zf1/commit/ff7edddf1410b44b5ead857c02698aad9f748d1b"
},
{
"type": "WEB",
"url": "https://framework.zend.com/security/advisory/ZF2015-06"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5161.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5161.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendxml/CVE-2015-5161.yaml"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200228055156/http://www.securityfocus.com/bid/76177"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/37765"
},
{
"type": "WEB",
"url": "http://framework.zend.com/security/advisory/ZF2015-06"
},
{
"type": "WEB",
"url": "http://legalhackers.com/advisories/zend-framework-XXE-vuln.txt"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164409.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165147.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165173.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/133068/Zend-Framework-2.4.2-1.12.13-XXE-Injection.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2015/Aug/46"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2015/dsa-3340"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/76177"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "ZendXml and Zend Framework contain XXE and XEE Vulnerabilities"
}
GHSA-XPH3-7HR2-G2JM
Vulnerability from github – Published: 2025-02-06 21:32 – Updated: 2025-02-06 21:32IBM EntireX 11.1 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
{
"affected": [],
"aliases": [
"CVE-2024-54171"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-06T21:15:21Z",
"severity": "HIGH"
},
"details": "IBM EntireX 11.1 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.",
"id": "GHSA-xph3-7hr2-g2jm",
"modified": "2025-02-06T21:32:10Z",
"published": "2025-02-06T21:32:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54171"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7182693"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XPJJ-RH44-8GF9
Vulnerability from github – Published: 2026-08-11 03:31 – Updated: 2026-08-11 03:31SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes the contents of sensitive server-side files within the resulting report. This results in a high impact on confidentiality, with no impact on integrity and availability.
{
"affected": [],
"aliases": [
"CVE-2026-58248"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T01:17:22Z",
"severity": "MODERATE"
},
"details": "SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes the contents of sensitive server-side files within the resulting report. This results in a high impact on confidentiality, with no impact on integrity and availability.",
"id": "GHSA-xpjj-rh44-8gf9",
"modified": "2026-08-11T03:31:57Z",
"published": "2026-08-11T03:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58248"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3753141"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XPPM-XGG9-R2GQ
Vulnerability from github – Published: 2026-10-12 18:31 – Updated: 2026-10-12 18:31Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure.
{
"affected": [],
"aliases": [
"CVE-2026-85957"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-12T17:17:35Z",
"severity": "HIGH"
},
"details": "Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure.",
"id": "GHSA-xppm-xgg9-r2gq",
"modified": "2026-10-12T18:31:55Z",
"published": "2026-10-12T18:31:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85957"
},
{
"type": "WEB",
"url": "https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XPW4-HQM8-RJ97
Vulnerability from github – Published: 2022-05-13 01:30 – Updated: 2025-04-20 03:50XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data.
{
"affected": [],
"aliases": [
"CVE-2014-3630"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-12-29T22:29:00Z",
"severity": "CRITICAL"
},
"details": "XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data.",
"id": "GHSA-xpw4-hqm8-rj97",
"modified": "2025-04-20T03:50:40Z",
"published": "2022-05-13T01:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3630"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!msg/play-framework/7uNX_ImTW08/AogWSjsTAyQJ"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!topic/play-framework/WdbFvemsFDQ"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#%21msg/play-framework/7uNX_ImTW08/AogWSjsTAyQJ"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#%21topic/play-framework/WdbFvemsFDQ"
},
{
"type": "WEB",
"url": "https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf"
},
{
"type": "WEB",
"url": "https://playframework.com/security/vulnerability/CVE-2014-3630-XmlExternalEntity"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.