Common Weakness Enumeration

CWE-611

Allowed

Improper Restriction of XML External Entity Reference

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

1696 vulnerabilities reference this CWE, most recent first.

GHSA-8QFC-CVJP-MGPQ

Vulnerability from github – Published: 2018-10-16 20:53 – Updated: 2021-09-07 20:29
VLAI
Summary
Moderate severity vulnerability that affects org.apache.ignite:ignite-core
Details

Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.

Severity
5.9 (Medium)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.ignite:ignite-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-6805"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:26:22Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.",
  "id": "GHSA-8qfc-cvjp-mgpq",
  "modified": "2021-09-07T20:29:22Z",
  "published": "2018-10-16T20:53:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6805"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-8qfc-cvjp-mgpq"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/oss-sec/2017/q2/31"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/97509"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Moderate severity vulnerability that affects org.apache.ignite:ignite-core"
}

GHSA-8QM5-3H3P-RC62

Vulnerability from github – Published: 2022-05-14 01:04 – Updated: 2022-05-14 01:04
VLAI
Details

Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license.

Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-20664"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-01-03T19:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license.",
  "id": "GHSA-8qm5-3h3p-rc62",
  "modified": "2022-05-14T01:04:11Z",
  "published": "2022-05-14T01:04:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20664"
    },
    {
      "type": "WEB",
      "url": "https://www.excellium-services.com/cert-xlm-advisory/cve-2018-20664"
    },
    {
      "type": "WEB",
      "url": "https://www.manageengine.com/products/self-service-password/release-notes.html#5701"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8QRP-R4QJ-W49R

Vulnerability from github – Published: 2022-05-24 17:46 – Updated: 2022-05-24 17:46
VLAI
Details

Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-6590"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-04-08T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure.",
  "id": "GHSA-8qrp-r4qj-w49r",
  "modified": "2022-05-24T17:46:57Z",
  "published": "2022-05-24T17:46:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6590"
    },
    {
      "type": "WEB",
      "url": "https://help.forcepoint.com/security/CVE/CVE-2020-6590.html"
    },
    {
      "type": "WEB",
      "url": "https://support.forcepoint.com/KBArticle?id=000019488"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-8R2M-WQJ6-FR2R

Vulnerability from github – Published: 2024-02-13 03:30 – Updated: 2024-02-13 03:30
VLAI
Details

SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so that availability is not affected.

Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-24743"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-13T03:15:09Z",
    "severity": "HIGH"
  },
  "details": "SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so that availability is not affected.\n\n",
  "id": "GHSA-8r2m-wqj6-fr2r",
  "modified": "2024-02-13T03:30:22Z",
  "published": "2024-02-13T03:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24743"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3426111"
    },
    {
      "type": "WEB",
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8R7R-HRCF-CGVW

Vulnerability from github – Published: 2026-03-27 15:30 – Updated: 2026-03-27 15:30
VLAI
Details

A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read local files via a crafted SVG file containing malicious xi:include tags.

Severity
6.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-4980"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-27T15:17:03Z",
    "severity": "MODERATE"
  },
  "details": "A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read local files via a crafted SVG file containing malicious xi:include tags.",
  "id": "GHSA-8r7r-hrcf-cgvw",
  "modified": "2026-03-27T15:30:26Z",
  "published": "2026-03-27T15:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4980"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/inkscape/inkscape/-/merge_requests/5269"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/inkscape/inkscape/-/work_items/3557"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8RC4-3JC3-83PM

Vulnerability from github – Published: 2022-05-14 03:13 – Updated: 2024-01-30 22:12
VLAI
Summary
XML External Entity processing vulnerability in Jenkins Black Duck Hub Plugin
Details

A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read permission to make Jenkins process XML eternal entities in an XML document.

Severity
6.5 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.0"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "com.blackducksoftware.integration:blackduck-hub"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2018-1000198"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-30T22:12:01Z",
    "nvd_published_at": "2018-06-05T21:29:00Z",
    "severity": "MODERATE"
  },
  "details": "A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read permission to make Jenkins process XML eternal entities in an XML document.",
  "id": "GHSA-8rc4-3jc3-83pm",
  "modified": "2024-01-30T22:12:10Z",
  "published": "2022-05-14T03:13:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000198"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2018-05-09/#SECURITY-671"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XML External Entity processing vulnerability in Jenkins Black Duck Hub Plugin"
}

GHSA-8RF9-8X75-VVG3

Vulnerability from github – Published: 2022-05-13 01:01 – Updated: 2022-05-13 01:01
VLAI
Details

An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in information disclosure and potential denial of service. An attacker can issue authenticated HTTP requests to trigger this vulnerability.

Severity
8.1 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-16349"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-08-02T19:29:00Z",
    "severity": "HIGH"
  },
  "details": "An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in information disclosure and potential denial of service. An attacker can issue authenticated HTTP requests to trigger this vulnerability.",
  "id": "GHSA-8rf9-8x75-vvg3",
  "modified": "2022-05-13T01:01:28Z",
  "published": "2022-05-13T01:01:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16349"
    },
    {
      "type": "WEB",
      "url": "https://www.talosintelligence.com/vulnerability_reports/SAP"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8RX6-V5Q4-XW3J

Vulnerability from github – Published: 2022-03-30 00:00 – Updated: 2023-10-27 19:23
VLAI
Summary
enkins Coverage/Complexity Scatter Plot Plugin XML External Entity Reference vulnerability
Details

Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control the input files for the 'Public Coverage / Complexity Scatter Plot' post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

As of publication of this advisory, there is no fix.

Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:covcomplplot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-28154"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-07T21:59:30Z",
    "nvd_published_at": "2022-03-29T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers able to control the input files for the \u0027Public Coverage / Complexity Scatter Plot\u0027 post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.\n\nAs of publication of this advisory, there is no fix.",
  "id": "GHSA-8rx6-v5q4-xw3j",
  "modified": "2023-10-27T19:23:02Z",
  "published": "2022-03-30T00:00:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28154"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/covcomplplot-plugin"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-1899"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2022/03/29/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "enkins Coverage/Complexity Scatter Plot Plugin XML External Entity Reference vulnerability"
}

GHSA-8VFM-4388-6RPC

Vulnerability from github – Published: 2018-10-16 23:06 – Updated: 2022-11-17 18:47
VLAI
Summary
Apache is vulnerable to XXE in XSD validation processor
Details

Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.

Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.20.0"
            },
            {
              "fixed": "2.20.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.21.0"
            },
            {
              "fixed": "2.21.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.21.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2018-8027"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:26:41Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.",
  "id": "GHSA-8vfm-4388-6rpc",
  "modified": "2022-11-17T18:47:38Z",
  "published": "2018-10-16T23:06:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8027"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/ec3d0db81ba061b27e934d5ff56e9baca0049eb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/9f7376abbff7434794f2c7c2909e02bac232fb5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/9c6a8f61de40c20f28240fbb2af4cb425793d41"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/99cbcd78b7e64083fae1d9552ead7425a90994b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/8afc5d1757795fde715902067360af5d90f046d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/87c92b7b38890c217bc76f2c55036e6a5cca9a0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/8467d644813a62f3a836c0c7dee8cf5a41de3c0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/3fe03e361725b66c1c3eaa40bb11577fb3dc17b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/2e8f21dec883b083ddcdddd802847b4c378a61a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/2c6964ae94d8f9a9c9a32e5ae5a0b794e8b8d3b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/24eefa559fe6b310629d2bf00663d2679ec81b9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/22c355bb4ffb500405499d189db30932ca5aac9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/camel"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/CAMEL-10894"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/CAMEL-12444"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/77f596fc63e63c2e9adcff3c34759b32c225cf0b582aedb755adaade@%3Cdev.camel.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-8vfm-4388-6rpc"
    },
    {
      "type": "WEB",
      "url": "http://camel.apache.org/security-advisories.data/CVE-2018-8027.txt.asc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache is vulnerable to XXE in XSD validation processor"
}

GHSA-8VGF-C76R-FP2X

Vulnerability from github – Published: 2025-02-20 12:31 – Updated: 2025-02-20 12:31
VLAI
Details

IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-49781"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-20T12:15:10Z",
    "severity": "HIGH"
  },
  "details": "IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.",
  "id": "GHSA-8vgf-c76r-fp2x",
  "modified": "2025-02-20T12:31:15Z",
  "published": "2025-02-20T12:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49781"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7183541"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Implementation System Configuration

Many XML parsers and validators can be configured to disable external entity expansion.

CAPEC-221: Data Serialization External Entities Blowup

This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.

← Back to the CWE list