CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1825 vulnerabilities reference this CWE, most recent first.
GHSA-CJ73-6R9W-RXVQ
Vulnerability from github – Published: 2022-05-14 03:43 – Updated: 2022-05-14 03:43Multiple XML external entity (XXE) vulnerabilities in the AiCloud feature on ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U, DSL-N66U, and DSL-AC750 routers allow remote authenticated users to read arbitrary files via a crafted DTD in (1) an UPDATEACCOUNT or (2) a PROPFIND request.
{
"affected": [],
"aliases": [
"CVE-2017-14699"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-29T16:29:00Z",
"severity": "MODERATE"
},
"details": "Multiple XML external entity (XXE) vulnerabilities in the AiCloud feature on ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U, DSL-N66U, and DSL-AC750 routers allow remote authenticated users to read arbitrary files via a crafted DTD in (1) an UPDATEACCOUNT or (2) a PROPFIND request.",
"id": "GHSA-cj73-6r9w-rxvq",
"modified": "2022-05-14T03:43:39Z",
"published": "2022-05-14T03:43:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14699"
},
{
"type": "WEB",
"url": "https://www.asus.com/Networking/DSL-N14U-B1/HelpDesk_BIOS"
},
{
"type": "WEB",
"url": "https://www.securityartwork.es/2018/01/25/some-vulnerability-in-asus-routers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CJ78-RGW3-4H5P
Vulnerability from github – Published: 2022-03-11 00:02 – Updated: 2022-03-28 15:56An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.46"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"events": [
{
"introduced": "6.1.0"
},
{
"fixed": "6.2.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "proteus"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "proteus"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "proteus"
},
"ranges": [
{
"events": [
{
"introduced": "6.1.0"
},
{
"fixed": "6.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-26661"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-28T15:56:00Z",
"nvd_published_at": "2022-03-10T17:47:00Z",
"severity": "MODERATE"
},
"details": "An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.",
"id": "GHSA-cj78-rgw3-4h5p",
"modified": "2022-03-28T15:56:00Z",
"published": "2022-03-11T00:02:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26661"
},
{
"type": "WEB",
"url": "https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059"
},
{
"type": "WEB",
"url": "https://foss.heptapod.net/tryton/tryton/-/issues/11219"
},
{
"type": "PACKAGE",
"url": "https://hg.tryton.org/trytond"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5098"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5099"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference in trytond and proteus"
}
GHSA-CJ8X-Q3V5-MMVX
Vulnerability from github – Published: 2023-11-14 12:30 – Updated: 2023-11-14 12:30A vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions < V2.8). Affected products suffer from a XML external entity (XXE) injection vulnerability. This vulnerability could allow an attacker to interfere with an application's processing of XML data and read arbitrary files in the system.
{
"affected": [],
"aliases": [
"CVE-2023-46590"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-14T11:15:15Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions \u003c V2.8). Affected products suffer from a XML external entity (XXE) injection vulnerability. This vulnerability could allow an attacker to interfere with an application\u0027s processing of XML data and read arbitrary files in the system.",
"id": "GHSA-cj8x-q3v5-mmvx",
"modified": "2023-11-14T12:30:27Z",
"published": "2023-11-14T12:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46590"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-197270.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CJH7-GP4Q-5Q3R
Vulnerability from github – Published: 2025-05-06 18:30 – Updated: 2025-05-06 18:30Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering.
{
"affected": [],
"aliases": [
"CVE-2025-22478"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-06T16:15:27Z",
"severity": "HIGH"
},
"details": "Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering.",
"id": "GHSA-cjh7-gp4q-5q3r",
"modified": "2025-05-06T18:30:38Z",
"published": "2025-05-06T18:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22478"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000317318/dsa-2025-191-security-update-for-storage-center-dell-storage-manager-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CJJ2-FJV5-5QRQ
Vulnerability from github – Published: 2023-05-10 06:30 – Updated: 2024-04-04 03:58Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.
{
"affected": [],
"aliases": [
"CVE-2023-27527"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-10T06:15:13Z",
"severity": "HIGH"
},
"details": "Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.",
"id": "GHSA-cjj2-fjv5-5qrq",
"modified": "2024-04-04T03:58:37Z",
"published": "2023-05-10T06:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27527"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN73178249"
},
{
"type": "WEB",
"url": "https://www.touki-kyoutaku-online.moj.go.jp"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CJX3-73HR-RPW7
Vulnerability from github – Published: 2026-09-24 19:35 – Updated: 2026-09-24 19:35http4s-scala-xml provides EntityDecoder[F, scala.xml.Elem] instances that parse XML message bodies. These decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs.
An application that uses these decoders to parse untrusted XML is vulnerable to XML External Entity (XXE) attacks. An attacker can craft a request that:
- discloses local files readable by the service process,
- performs server-side request forgery (SSRF) against internal network resources, and/or
- causes denial of service through entity expansion.
Impact
Any service that derives an XML EntityDecoder from this library and parses attacker-controlled input is affected.
Patches
The default SAXParserFactory is now hardened:
- secure processing is enabled
- DOCTYPE declarations are disallowed
- external general/parameter entities and external DTD loading are disabled
- DTD URIs are not resolved
- XInclude is disabled.
These defaults match scala.xml.XMLLoader's defaults since 2.0.0.
Workarounds
Before upgrading, override ElemInstances#saxFactory with a hardened factory.
val secured = new ElemInstances {
override protected val saxFactory = {
val f = javax.xml.parsers.SAXParserFactory.newInstance
f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
// etc.
f
}
}
import secured._
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.24.0"
},
"package": {
"ecosystem": "Maven",
"name": "org.http4s:http4s-scala-xml_2.12"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.24.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.24.0"
},
"package": {
"ecosystem": "Maven",
"name": "org.http4s:http4s-scala-xml_2.13"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.24.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.0.0-M38.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.http4s:http4s-scala-xml_2.13"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0-M1"
},
{
"fixed": "1.0.0-M39"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.24.0"
},
"package": {
"ecosystem": "Maven",
"name": "org.http4s:http4s-scala-xml_3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.24.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.0.0-M38.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.http4s:http4s-scala-xml_3"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0-M1"
},
{
"fixed": "1.0.0-M39"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-61741"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-24T19:35:16Z",
"nvd_published_at": "2026-09-24T18:17:16Z",
"severity": "CRITICAL"
},
"details": "http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. These decoders used a `javax.xml.parsers.SAXParserFactory` obtained from `SAXParserFactory.newInstance` without any security configuration. With the JDK\u0027s default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs.\n\nAn application that uses these decoders to parse untrusted XML is vulnerable to XML External Entity (XXE) attacks. An attacker can craft a request that:\n\n- discloses local files readable by the service process,\n- performs server-side request forgery (SSRF) against internal network resources, and/or\n- causes denial of service through entity expansion.\n\n### Impact\n\nAny service that derives an XML `EntityDecoder` from this library and parses attacker-controlled input is affected.\n\n### Patches\n\nThe default SAXParserFactory is now hardened: \n- secure processing is enabled\n- `DOCTYPE` declarations are disallowed\n- external general/parameter entities and external DTD loading are disabled\n- DTD URIs are not resolved\n- XInclude is disabled.\n\nThese defaults match `scala.xml.XMLLoader`\u0027s defaults since 2.0.0.\n\n### Workarounds\n\nBefore upgrading, override `ElemInstances#saxFactory` with a hardened factory.\n\n```scala\n val secured = new ElemInstances {\n override protected val saxFactory = {\n val f = javax.xml.parsers.SAXParserFactory.newInstance\n f.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true)\n // etc.\n f\n }\n }\n import secured._\n```",
"id": "GHSA-cjx3-73hr-rpw7",
"modified": "2026-09-24T19:35:16Z",
"published": "2026-09-24T19:35:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/http4s/http4s-scala-xml/security/advisories/GHSA-cjx3-73hr-rpw7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61741"
},
{
"type": "WEB",
"url": "https://github.com/http4s/http4s-scala-xml/commit/326f965a2c45fc2ddbc22545dcf551b0f719f4c8"
},
{
"type": "PACKAGE",
"url": "https://github.com/http4s/http4s-scala-xml"
},
{
"type": "WEB",
"url": "https://github.com/http4s/http4s-scala-xml/releases/tag/v0.24.1"
},
{
"type": "WEB",
"url": "https://github.com/http4s/http4s-scala-xml/releases/tag/v1.0.0-M39"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "http4s-scala-xml has an XML External Entity (XXE) processing issue"
}
GHSA-CM3H-688R-2C3X
Vulnerability from github – Published: 2022-05-13 01:04 – Updated: 2022-05-13 01:04Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.
{
"affected": [],
"aliases": [
"CVE-2018-7783"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-03T14:29:00Z",
"severity": "HIGH"
},
"details": "Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.",
"id": "GHSA-cm3h-688r-2c3x",
"modified": "2022-05-13T01:04:09Z",
"published": "2022-05-13T01:04:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7783"
},
{
"type": "WEB",
"url": "https://www.schneider-electric.com/en/download/document/SEVD-2018-142-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CMCG-F6R6-G4HH
Vulnerability from github – Published: 2024-05-15 18:30 – Updated: 2025-01-21 18:31XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to information disclosure and remote code execution.
{
"affected": [],
"aliases": [
"CVE-2024-3486"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-15T17:15:13Z",
"severity": "HIGH"
},
"details": "XML External Entity injection vulnerability found\u00a0in OpenText\u2122 iManager 3.2.6.0200. This could lead to information disclosure and remote code execution.\n\n",
"id": "GHSA-cmcg-f6r6-g4hh",
"modified": "2025-01-21T18:31:03Z",
"published": "2024-05-15T18:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3486"
},
{
"type": "WEB",
"url": "https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CMG9-P9GP-G7MR
Vulnerability from github – Published: 2024-02-13 06:30 – Updated: 2024-02-13 06:30An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.
{
"affected": [],
"aliases": [
"CVE-2024-22024"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-13T04:15:07Z",
"severity": "HIGH"
},
"details": "An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.",
"id": "GHSA-cmg9-p9gp-g7mr",
"modified": "2024-02-13T06:30:28Z",
"published": "2024-02-13T06:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22024"
},
{
"type": "WEB",
"url": "https://forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-CMGM-Q8HF-P7JC
Vulnerability from github – Published: 2022-05-24 17:13 – Updated: 2022-12-20 14:35Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows a user able to control the input files for the \"Publish Coverage Report\" post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Code Coverage API Plugin 1.1.5 disables external entity resolution for its XML parser.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.jenkins.plugins:code-coverage-api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2172"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-20T14:35:40Z",
"nvd_published_at": "2020-04-07T13:15:00Z",
"severity": "HIGH"
},
"details": "Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows a user able to control the input files for the \\\"Publish Coverage Report\\\" post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.\n\nCode Coverage API Plugin 1.1.5 disables external entity resolution for its XML parser.",
"id": "GHSA-cmgm-q8hf-p7jc",
"modified": "2022-12-20T14:35:40Z",
"published": "2022-05-24T17:13:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2172"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/code-coverage-api-plugin/commit/f0ef84c25f7bc4de4e722e994de57d238225834c"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/code-coverage-api-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2020-04-07/#SECURITY-1699"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/04/07/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in Jenkins Code Coverage API Plugin"
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.