CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1696 vulnerabilities reference this CWE, most recent first.
GHSA-92WJ-X78C-M4FX
Vulnerability from github – Published: 2019-01-07 19:14 – Updated: 2023-09-11 22:40Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.karaf.specs:org.apache.karaf.specs.java.xml"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.karaf.specs:org.apache.karaf.specs.java.xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-11788"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:27:16Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Apache Karaf provides a features deployer, which allows users to \"hot deploy\" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn\u0027t contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.",
"id": "GHSA-92wj-x78c-m4fx",
"modified": "2023-09-11T22:40:24Z",
"published": "2019-01-07T19:14:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11788"
},
{
"type": "WEB",
"url": "https://github.com/apache/karaf/commit/0c36c50bc158739c8fc8543122a6740c54adafca"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/karaf"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200227101219/https://www.securityfocus.com/bid/106479"
},
{
"type": "WEB",
"url": "http://karaf.apache.org/security/cve-2018-11788.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XML External Entity Reference in Apache Karaf"
}
GHSA-93GM-2PXG-46P3
Vulnerability from github – Published: 2023-01-09 12:30 – Updated: 2023-01-13 00:30A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The manipulation leads to xml external entity reference. The name of the patch is 31d442b9fb1d518128fd18f6e4d54e06c3d67793. It is recommended to apply a patch to fix this issue. VDB-217666 is the identifier assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2021-4311"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-09T12:15:00Z",
"severity": "CRITICAL"
},
"details": "A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The manipulation leads to xml external entity reference. The name of the patch is 31d442b9fb1d518128fd18f6e4d54e06c3d67793. It is recommended to apply a patch to fix this issue. VDB-217666 is the identifier assigned to this vulnerability.",
"id": "GHSA-93gm-2pxg-46p3",
"modified": "2023-01-13T00:30:41Z",
"published": "2023-01-09T12:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4311"
},
{
"type": "WEB",
"url": "https://github.com/Talend/tmdm-server-se/pull/1420"
},
{
"type": "WEB",
"url": "https://github.com/Talend/tmdm-server-se/commit/31d442b9fb1d518128fd18f6e4d54e06c3d67793"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.217666"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.217666"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-93HF-XXFJ-6GX3
Vulnerability from github – Published: 2022-05-24 19:14 – Updated: 2022-05-24 19:14XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a local user to initiate high CPU and memory consumption resulting in a Denial of Service attack through carefully editing the EPDeploy.xml file and then executing the setup process.
{
"affected": [],
"aliases": [
"CVE-2021-31842"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-17T14:15:00Z",
"severity": "MODERATE"
},
"details": "XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a local user to initiate high CPU and memory consumption resulting in a Denial of Service attack through carefully editing the EPDeploy.xml file and then executing the setup process.",
"id": "GHSA-93hf-xxfj-6gx3",
"modified": "2022-05-24T19:14:57Z",
"published": "2022-05-24T19:14:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31842"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10367"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-93X2-2W8G-55M7
Vulnerability from github – Published: 2022-05-14 02:47 – Updated: 2025-04-20 03:44XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.
{
"affected": [],
"aliases": [
"CVE-2015-7241"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-06T21:29:00Z",
"severity": "CRITICAL"
},
"details": "XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.",
"id": "GHSA-93x2-2w8g-55m7",
"modified": "2025-04-20T03:44:22Z",
"published": "2022-05-14T02:47:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7241"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/38261"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/133627/SAP-Netweaver-XML-External-Entity-Injection.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/536504/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/76809"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-94CH-W8WC-29RX
Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 152534.
{
"affected": [],
"aliases": [
"CVE-2018-1905"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-26T16:29:00Z",
"severity": "HIGH"
},
"details": "IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 152534.",
"id": "GHSA-94ch-w8wc-29rx",
"modified": "2022-05-13T01:32:31Z",
"published": "2022-05-13T01:32:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1905"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/152534"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10738721"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106030"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-9563-9277-F9W9
Vulnerability from github – Published: 2022-05-14 01:14 – Updated: 2022-05-14 01:14The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. This allowed malicious oauth application linked applications to probe internal network resources by requesting internal locations, read the contents of files and also cause an out of memory exception affecting availability via an XML External Entity vulnerability.
{
"affected": [],
"aliases": [
"CVE-2017-18111"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-29T14:29:00Z",
"severity": "HIGH"
},
"details": "The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. This allowed malicious oauth application linked applications to probe internal network resources by requesting internal locations, read the contents of files and also cause an out of memory exception affecting availability via an XML External Entity vulnerability.",
"id": "GHSA-9563-9277-f9w9",
"modified": "2022-05-14T01:14:26Z",
"published": "2022-05-14T01:14:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18111"
},
{
"type": "WEB",
"url": "https://ecosystem.atlassian.net/browse/APL-1338"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-95HQ-2W8Q-XW2V
Vulnerability from github – Published: 2022-05-25 00:00 – Updated: 2022-06-09 00:00An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker can send a request crafted with an XXE payload to invoke a malicious DTD hosted on a system that they control. This results in reading local files that the application has access to.
{
"affected": [],
"aliases": [
"CVE-2022-31261"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-24T15:15:00Z",
"severity": "HIGH"
},
"details": "An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker can send a request crafted with an XXE payload to invoke a malicious DTD hosted on a system that they control. This results in reading local files that the application has access to.",
"id": "GHSA-95hq-2w8q-xw2v",
"modified": "2022-06-09T00:00:19Z",
"published": "2022-05-25T00:00:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31261"
},
{
"type": "WEB",
"url": "https://docs.morpheusdata.com/en/5.4.4/release_notes/current.html"
},
{
"type": "WEB",
"url": "https://support.morpheusdata.com/s/?language=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-965X-72V5-49V5
Vulnerability from github – Published: 2022-11-16 19:00 – Updated: 2022-11-18 06:30An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.
{
"affected": [],
"aliases": [
"CVE-2022-3980"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-16T13:15:00Z",
"severity": "CRITICAL"
},
"details": "An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.",
"id": "GHSA-965x-72v5-49v5",
"modified": "2022-11-18T06:30:35Z",
"published": "2022-11-16T19:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3980"
},
{
"type": "WEB",
"url": "https://www.sophos.com/en-us/security-advisories/sophos-sa-20221116-smc-xee"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-96J8-8455-Q77X
Vulnerability from github – Published: 2025-09-09 15:31 – Updated: 2025-09-09 15:31A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is considered end-of-life as of December 2023. Users are advised to upgrade to TecCom Connect 5.
{
"affected": [],
"aliases": [
"CVE-2025-10183"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-09T15:15:32Z",
"severity": "CRITICAL"
},
"details": "A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is considered end-of-life as of December 2023. Users are advised to upgrade to TecCom Connect 5.",
"id": "GHSA-96j8-8455-q77x",
"modified": "2025-09-09T15:31:19Z",
"published": "2025-09-09T15:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10183"
},
{
"type": "WEB",
"url": "https://blog.blacklanternsecurity.com/p/teccom-tecconnect-41-xml-external"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-975R-CFGJ-8MHF
Vulnerability from github – Published: 2026-02-11 21:30 – Updated: 2026-02-11 21:30MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that references external entities to retrieve sensitive system configuration information.
{
"affected": [],
"aliases": [
"CVE-2020-37192"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-11T21:16:13Z",
"severity": "MODERATE"
},
"details": "MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the \u0027Favorites\u0027 tab by injecting a malicious XML file that references external entities to retrieve sensitive system configuration information.",
"id": "GHSA-975r-cfgj-8mhf",
"modified": "2026-02-11T21:30:41Z",
"published": "2026-02-11T21:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37192"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/47896"
},
{
"type": "WEB",
"url": "https://www.top-password.com"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/msn-password-recovery-xml-external-entity-injection"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.