CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1825 vulnerabilities reference this CWE, most recent first.
GHSA-998J-J6V9-5846
Vulnerability from github – Published: 2022-05-17 04:39 – Updated: 2024-03-05 00:07The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.solr:solr-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2013-6407"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-22T18:47:28Z",
"nvd_published_at": "2013-12-07T20:55:00Z",
"severity": "MODERATE"
},
"details": "The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"id": "GHSA-998j-j6v9-5846",
"modified": "2024-03-05T00:07:43Z",
"published": "2022-05-17T04:39:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6407"
},
{
"type": "WEB",
"url": "https://github.com/apache/lucene-solr/commit/f230486ce6707762c1a6e81655d0fac52887906d"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/lucene-solr"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/SOLR-3895"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1844.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0029.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/55542"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59372"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt?view=markup"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/11/29/2"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Apache Solr UpdateRequestHandler for XML resolves XML External Entities"
}
GHSA-99G7-5P97-G9VW
Vulnerability from github – Published: 2022-05-17 03:17 – Updated: 2022-05-17 03:17perl-Image-Info: When parsing an SVG file, external entity expansion (XXE) was not disabled. An attacker could craft an SVG file which, when processed by an application using perl-Image-Info, could cause denial of service or, potentially, information disclosure.
{
"affected": [],
"aliases": [
"CVE-2016-9181"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-12-22T21:59:00Z",
"severity": "HIGH"
},
"details": "perl-Image-Info: When parsing an SVG file, external entity expansion (XXE) was not disabled. An attacker could craft an SVG file which, when processed by an application using perl-Image-Info, could cause denial of service or, potentially, information disclosure.",
"id": "GHSA-99g7-5p97-g9vw",
"modified": "2022-05-17T03:17:54Z",
"published": "2022-05-17T03:17:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9181"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1379556"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/11/04/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94220"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-99WH-973F-779P
Vulnerability from github – Published: 2022-03-04 00:00 – Updated: 2022-03-18 21:04The AbstractXmlConfigRootTagRecognizer() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "5.1-beta1"
},
{
"fixed": "5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-0265"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-04T19:44:17Z",
"nvd_published_at": "2022-03-03T22:15:00Z",
"severity": "CRITICAL"
},
"details": "The AbstractXmlConfigRootTagRecognizer() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.",
"id": "GHSA-99wh-973f-779p",
"modified": "2022-03-18T21:04:06Z",
"published": "2022-03-04T00:00:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0265"
},
{
"type": "WEB",
"url": "https://github.com/hazelcast/hazelcast/pull/20407"
},
{
"type": "WEB",
"url": "https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748"
},
{
"type": "WEB",
"url": "https://github.com/hazelcast/hazelcast"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XML External Entity Reference in Hazelcast"
}
GHSA-9G7F-QQQ7-J65J
Vulnerability from github – Published: 2022-05-24 16:51 – Updated: 2024-03-21 03:33Axway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API configuration) is vulnerable to unauthenticated blind XML injection (and XXE) in the resetPassword functionality via the REST API. This vulnerability can lead to local file disclosure, DoS, or URI invocation attacks (i.e., SSRF with resultant remote code execution).
{
"affected": [],
"aliases": [
"CVE-2019-14277"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-91"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-26T04:15:00Z",
"severity": "CRITICAL"
},
"details": "Axway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API configuration) is vulnerable to unauthenticated blind XML injection (and XXE) in the resetPassword functionality via the REST API. This vulnerability can lead to local file disclosure, DoS, or URI invocation attacks (i.e., SSRF with resultant remote code execution).",
"id": "GHSA-9g7f-qqq7-j65j",
"modified": "2024-03-21T03:33:41Z",
"published": "2022-05-24T16:51:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14277"
},
{
"type": "WEB",
"url": "https://community.axway.com/s/article/SecureTransport-Security-Notice"
},
{
"type": "WEB",
"url": "https://community.axway.com/s/article/SecureTransport-Security-Notice-re-CVE-2019-14277-Unauthenticated-XML-Injection-and-XXE"
},
{
"type": "WEB",
"url": "https://gist.githubusercontent.com/zeropwn/59f17727dfaba239b0ace6f33b752974/raw/9b6541a94ac5ec181a88e6c84cb3e3001025b8fd/Axway%2520SecureTransport%25205.x%2520Unauthenticated%2520XXE"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/47150"
},
{
"type": "WEB",
"url": "https://zero.lol/2019-07-21-axway-securetransport-xml-injection"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9GFR-GVQF-X6R8
Vulnerability from github – Published: 2023-02-17 18:30 – Updated: 2023-02-28 21:30An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function.
{
"affected": [],
"aliases": [
"CVE-2021-33950"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-17T18:15:00Z",
"severity": "HIGH"
},
"details": "An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function.",
"id": "GHSA-9gfr-gvqf-x6r8",
"modified": "2023-02-28T21:30:17Z",
"published": "2023-02-17T18:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33950"
},
{
"type": "WEB",
"url": "https://github.com/openkm/document-management-system/issues/287"
},
{
"type": "WEB",
"url": "https://github.com/openkm/document-management-system/pull/288"
},
{
"type": "WEB",
"url": "https://github.com/openkm/document-management-system/commit/ce1d82329615aea6aa9f2cc6508c1fe7891e34b5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9H75-C39J-RXJX
Vulnerability from github – Published: 2022-05-14 00:55 – Updated: 2022-05-14 00:55A vulnerability in the web-based user interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker read and write access to information stored in the affected system as well as perform remote code execution. The attacker must have valid user credentials. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file with malicious entries which could allow the attacker to read and write files and execute remote code within the application, aka XML Injection. Cisco Prime Infrastructure software releases 1.1 through 3.1.6 are vulnerable. Cisco EPNM software releases 1.2, 2.0, and 2.1 are vulnerable. Cisco Bug IDs: CSCvc23894 CSCvc49561.
{
"affected": [],
"aliases": [
"CVE-2017-6662"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-26T07:29:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in the web-based user interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker read and write access to information stored in the affected system as well as perform remote code execution. The attacker must have valid user credentials. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file with malicious entries which could allow the attacker to read and write files and execute remote code within the application, aka XML Injection. Cisco Prime Infrastructure software releases 1.1 through 3.1.6 are vulnerable. Cisco EPNM software releases 1.2, 2.0, and 2.1 are vulnerable. Cisco Bug IDs: CSCvc23894 CSCvc49561.",
"id": "GHSA-9h75-c39j-rxjx",
"modified": "2022-05-14T00:55:31Z",
"published": "2022-05-14T00:55:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6662"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-piepnm1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99194"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038750"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9HQX-G6F2-RJ2P
Vulnerability from github – Published: 2026-09-10 21:31 – Updated: 2026-09-10 21:31An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled (for example a compromised monitored host or an HTTP man-in-the-middle position), the collector's XML parser resolves external entities and external DTDs. This allows an attacker to read files accessible to the OpenNMS service account, including database credentials, and to induce out-of-band requests.
The solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
{
"affected": [],
"aliases": [
"CVE-2026-19596"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-10T21:17:25Z",
"severity": "MODERATE"
},
"details": "An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled (for example a compromised monitored host or an HTTP man-in-the-middle position), the collector\u0027s XML parser resolves external entities and external DTDs. This allows an attacker to read files accessible to the OpenNMS service account, including database credentials, and to induce out-of-band requests.\n\n\n\nThe solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet.",
"id": "GHSA-9hqx-g6f2-rj2p",
"modified": "2026-09-10T21:31:36Z",
"published": "2026-09-10T21:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19596"
},
{
"type": "WEB",
"url": "https://github.com/OpenNMS/opennms/pull/8782"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9HXQ-VV35-9R5R
Vulnerability from github – Published: 2024-08-08 00:31 – Updated: 2024-08-08 15:31The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.
{
"affected": [],
"aliases": [
"CVE-2024-6893"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-08T00:15:40Z",
"severity": "HIGH"
},
"details": "The \"soap_cgi.pyc\" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.",
"id": "GHSA-9hxq-vv35-9r5r",
"modified": "2024-08-08T15:31:30Z",
"published": "2024-08-08T00:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6893"
},
{
"type": "WEB",
"url": "https://korelogic.com/Resources/Advisories/KL-001-2024-010.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9J36-XV3G-RVH5
Vulnerability from github – Published: 2025-09-08 12:30 – Updated: 2025-09-08 12:30A vulnerability has been found in Jinher OA up to 1.2. This affects an unknown function of the file /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Type=add of the component XML Handler. The manipulation leads to xml external entity reference. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
{
"affected": [],
"aliases": [
"CVE-2025-10091"
],
"database_specific": {
"cwe_ids": [
"CWE-610",
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-08T11:15:30Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in Jinher OA up to 1.2. This affects an unknown function of the file /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Type=add of the component XML Handler. The manipulation leads to xml external entity reference. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-9j36-xv3g-rvh5",
"modified": "2025-09-08T12:30:33Z",
"published": "2025-09-08T12:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10091"
},
{
"type": "WEB",
"url": "https://github.com/Cstarplus/CVE/issues/2"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.323046"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.323046"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.644864"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9JCP-9VH9-R3W5
Vulnerability from github – Published: 2024-11-04 18:31 – Updated: 2024-11-06 00:31An XML External Entity (XXE) vulnerability in Dmoz2CSV in openimaj v1.3.10 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted XML file.
{
"affected": [],
"aliases": [
"CVE-2024-51136"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-91"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-04T17:15:08Z",
"severity": "CRITICAL"
},
"details": "An XML External Entity (XXE) vulnerability in Dmoz2CSV in openimaj v1.3.10 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted XML file.",
"id": "GHSA-9jcp-9vh9-r3w5",
"modified": "2024-11-06T00:31:55Z",
"published": "2024-11-04T18:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51136"
},
{
"type": "WEB",
"url": "https://github.com/openimaj/openimaj/issues/382"
},
{
"type": "WEB",
"url": "https://github.com/openimaj/openimaj"
},
{
"type": "WEB",
"url": "https://mvnrepository.com/artifact/org.openimaj.tools/WebTools"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.