CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1695 vulnerabilities reference this CWE, most recent first.
GHSA-6X4W-8W53-XRVV
Vulnerability from github – Published: 2020-09-14 18:44 – Updated: 2020-09-14 18:42Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) or (2) JSTL XML tag.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.taglibs:taglibs-standard"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.taglibs:taglibs-standard-impl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-0254"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-09-14T18:42:48Z",
"nvd_published_at": "2015-03-09T14:59:00Z",
"severity": "HIGH"
},
"details": "Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) \u003cx:parse\u003e or (2) \u003cx:transform\u003e JSTL XML tag.",
"id": "GHSA-6x4w-8w53-xrvv",
"modified": "2020-09-14T18:42:48Z",
"published": "2020-09-14T18:44:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0254"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1376"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/8a20e48acb2a40be5130df91cf9d39d8ad93181989413d4abcaa4914@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r6c93d8ade3788dbc00f5a37238bc278e7d859f2446b885460783a16f@%3Cpluto-dev.portals.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rc1686f6196bb9063bf26577a21b8033c19c1a30e5a9159869c8f3d38@%3Cpluto-dev.portals.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf1179e6971bc46f0f68879a9a10cc97ad4424451b0889aeef04c8077@%3Cpluto-scm.portals.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rfc2bfd99c340dafd501676693cd889c1f9f838b97bdd0776a8f5557d@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-10/msg00033.html"
},
{
"type": "WEB",
"url": "http://mail-archives.apache.org/mod_mbox/tomcat-taglibs-user/201502.mbox/%3C82207A16-6348-4DEE-877E-F7B87292576A%40apache.org%3E"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/130575/Apache-Standard-Taglibs-1.2.1-XXE-Remote-Command-Execution.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1695.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1838.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1839.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1840.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1841.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/534772/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/72809"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1034934"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2551-1"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "XXE in Apache Standard Taglibs"
}
GHSA-6XM7-3CC5-47F9
Vulnerability from github – Published: 2022-09-08 00:00 – Updated: 2022-09-16 17:19DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mei2volpiano"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.8.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-37189"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-16T17:19:30Z",
"nvd_published_at": "2022-09-07T13:15:00Z",
"severity": "HIGH"
},
"details": "DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe \u0027xml.etree\u0027 library to parse untrusted XML input.",
"id": "GHSA-6xm7-3cc5-47f9",
"modified": "2022-09-16T17:19:30Z",
"published": "2022-09-08T00:00:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37189"
},
{
"type": "WEB",
"url": "https://docs.python.org/3/library/xml.html#xml-vulnerabilities"
},
{
"type": "WEB",
"url": "https://github.com/DDMAL/MEI2Volpiano"
},
{
"type": "WEB",
"url": "https://github.com/DDMAL/MEI2Volpiano/blob/987b70fff991235e682405f901388af0f414eaa8/mei2volpiano/mei2volpiano.py#L59"
},
{
"type": "WEB",
"url": "https://pyup.io/vulnerabilities/CVE-2022-37189/50928"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)"
}
GHSA-6XMX-H98X-6VXG
Vulnerability from github – Published: 2022-05-24 17:47 – Updated: 2022-05-24 17:47XML External Entity Resolution (XXE) in Helix ALM. The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software components, leading to XXE attacks.
{
"affected": [],
"aliases": [
"CVE-2021-29997"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-13T17:15:00Z",
"severity": "CRITICAL"
},
"details": "XML External Entity Resolution (XXE) in Helix ALM. The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software components, leading to XXE attacks.",
"id": "GHSA-6xmx-h98x-6vxg",
"modified": "2022-05-24T17:47:29Z",
"published": "2022-05-24T17:47:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29997"
},
{
"type": "WEB",
"url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2021-29997"
},
{
"type": "WEB",
"url": "https://support2.windriver.com/index.php?page=security-notices"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6XQ3-JGFV-2JH3
Vulnerability from github – Published: 2025-04-08 15:31 – Updated: 2025-04-08 15:31An XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch and parse the XML response.
{
"affected": [],
"aliases": [
"CVE-2025-32406"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-08T15:15:50Z",
"severity": "MODERATE"
},
"details": "An XXE issue in the Director NBR component in NAKIVO Backup \u0026 Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch and parse the XML response.",
"id": "GHSA-6xq3-jgfv-2jh3",
"modified": "2025-04-08T15:31:06Z",
"published": "2025-04-08T15:31:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32406"
},
{
"type": "WEB",
"url": "https://helpcenter.nakivo.com/Knowledge-Base/Content/Security-Advisory/CVE-2025-32406.htm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6XQ8-PVG4-3MF3
Vulnerability from github – Published: 2018-10-19 16:54 – Updated: 2025-10-15 16:43Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.rdf4j:rdf4j-runtime"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1000644"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:20:48Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Eclipse RDF4j version \u003c 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.",
"id": "GHSA-6xq8-pvg4-3mf3",
"modified": "2025-10-15T16:43:16Z",
"published": "2018-10-19T16:54:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000644"
},
{
"type": "WEB",
"url": "https://github.com/eclipse/rdf4j/issues/1056"
},
{
"type": "WEB",
"url": "https://0dd.zone/2018/08/05/rdf4j-XXE"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-6xq8-pvg4-3mf3"
},
{
"type": "PACKAGE",
"url": "https://github.com/eclipse/rdf4j"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Eclipse RDF4j vulnerable to XML External Entity"
}
GHSA-728W-FQ42-M52C
Vulnerability from github – Published: 2025-04-17 00:30 – Updated: 2025-04-17 00:30Overview
XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g. in an error message), thereby exposing the file contents. (CWE-611)
Description
Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.2, including 9.3.x and 8.3.x, do not correctly protect Pentaho Data Integration MessageSourceCrawler against out-of-band XML External Entity Reference.
Impact
By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. Using URIs with other schemes such as http://, the attacker can force the application to make outgoing requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions or hide the source of attacks such as port scanning.
{
"affected": [],
"aliases": [
"CVE-2025-24910"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T23:15:45Z",
"severity": "MODERATE"
},
"details": "Overview \n\n\n\n\u00a0\n\n\n\nXML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g. in an error message), thereby exposing the file contents. (CWE-611) \n\n\n\n\u00a0\n\n\n\nDescription \n\n\n\n\u00a0\n\n\n\nHitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.2, including 9.3.x and 8.3.x, do not correctly protect Pentaho Data Integration MessageSourceCrawler against out-of-band XML External Entity Reference. \n\n\n\n\u00a0\n\n\n\nImpact \n\n\n\n\u00a0\n\n\n\nBy submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. Using URIs with other schemes such as http://, the attacker can force the application to make outgoing requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions or hide the source of attacks such as port scanning.",
"id": "GHSA-728w-fq42-m52c",
"modified": "2025-04-17T00:30:26Z",
"published": "2025-04-17T00:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24910"
},
{
"type": "WEB",
"url": "https://support.pentaho.com/hc/en-us/articles/35782683750541--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Restriction-of-XML-External-Entity-Reference-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-24910"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-732F-W585-GMPC
Vulnerability from github – Published: 2022-05-24 19:05 – Updated: 2023-10-27 15:23Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers with the ability to call webhooks configured to extract parameters using XPath to have Jenkins parse a crafted XML request body that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Jenkins Generic Webhook Trigger Plugin 1.74 disables external entity resolution for its XML parser.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.72"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:generic-webhook-trigger"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.74"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21669"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-08-26T16:28:18Z",
"nvd_published_at": "2021-06-18T10:15:00Z",
"severity": "CRITICAL"
},
"details": "Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers with the ability to call webhooks configured to extract parameters using XPath to have Jenkins parse a crafted XML request body that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.\n\nJenkins Generic Webhook Trigger Plugin 1.74 disables external entity resolution for its XML parser.",
"id": "GHSA-732f-w585-gmpc",
"modified": "2023-10-27T15:23:32Z",
"published": "2022-05-24T19:05:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21669"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/generic-webhook-trigger-plugin/commit/da434dfca1b82f5de81e29438762370d652493b8"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/generic-webhook-trigger-plugin"
},
{
"type": "WEB",
"url": "https://plugins.jenkins.io/generic-webhook-trigger/#dependencies"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2021-06-18/#SECURITY-2330"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/06/18/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in Jenkins Generic Webhook Trigger Plugin"
}
GHSA-7358-GHCM-C3FF
Vulnerability from github – Published: 2022-09-13 00:00 – Updated: 2022-09-16 00:00Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20, 2022. The XML parser in the Policy Engine was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. This issue affects: Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2. Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2. Forcepoint Web Security Content Gateway versions prior to 8.5.5. Forcepoint Email Security with DLP enabled versions prior to 8.5.5. Forcepoint Cloud Security Gateway prior to June 20, 2022.
{
"affected": [],
"aliases": [
"CVE-2022-1700"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-12T19:15:00Z",
"severity": "CRITICAL"
},
"details": "Improper Restriction of XML External Entity Reference (\u0027XXE\u0027) vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20, 2022. The XML parser in the Policy Engine was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. This issue affects: Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2. Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2. Forcepoint Web Security Content Gateway versions prior to 8.5.5. Forcepoint Email Security with DLP enabled versions prior to 8.5.5. Forcepoint Cloud Security Gateway prior to June 20, 2022.",
"id": "GHSA-7358-ghcm-c3ff",
"modified": "2022-09-16T00:00:33Z",
"published": "2022-09-13T00:00:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1700"
},
{
"type": "WEB",
"url": "https://help.forcepoint.com/security/CVE/CVE-2022-1700.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-73F3-RQQF-2J54
Vulnerability from github – Published: 2026-02-03 18:30 – Updated: 2026-02-03 19:53Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby causing sensitive data leakage occurs.
This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3.
Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.syncope.client.idrepo:syncope-client-idrepo-console"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.syncope.client.idrepo:syncope-client-idrepo-console"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-23795"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-03T19:53:38Z",
"nvd_published_at": "2026-02-03T16:16:13Z",
"severity": "MODERATE"
},
"details": "Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby causing sensitive data leakage occurs.\n\nThis issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3.\n\nUsers are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.",
"id": "GHSA-73f3-rqqf-2j54",
"modified": "2026-02-03T19:53:38Z",
"published": "2026-02-03T18:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23795"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/syncope"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/mzgbdn8hzk8vr94o660njcc7w62c2pos"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/02/02/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Syncope: Console XXE on Keymaster parameters"
}
GHSA-744R-VV2G-2X6G
Vulnerability from github – Published: 2019-12-02 18:17 – Updated: 2021-06-15 17:22The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.nifi:nifi-security"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.0"
},
{
"fixed": "1.10.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.nifi:nifi"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.0"
},
{
"fixed": "1.10.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-10080"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2019-12-02T17:27:21Z",
"nvd_published_at": "2019-11-19T22:15:00Z",
"severity": "MODERATE"
},
"details": "The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.",
"id": "GHSA-744r-vv2g-2x6g",
"modified": "2021-06-15T17:22:36Z",
"published": "2019-12-02T18:17:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10080"
},
{
"type": "WEB",
"url": "https://github.com/apache/nifi/pull/3507"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E"
},
{
"type": "WEB",
"url": "https://nifi.apache.org/security.html#CVE-2019-10080"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache NiFi information disclosure by XXE"
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.