CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1829 vulnerabilities reference this CWE, most recent first.
GHSA-MMCG-C68Q-4P38
Vulnerability from github – Published: 2022-05-13 01:11 – Updated: 2022-05-13 01:11ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
{
"affected": [],
"aliases": [
"CVE-2013-1915"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-04-25T23:55:00Z",
"severity": "HIGH"
},
"details": "ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.",
"id": "GHSA-mmcg-c68q-4p38",
"modified": "2022-05-13T01:11:43Z",
"published": "2022-05-13T01:11:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1915"
},
{
"type": "WEB",
"url": "https://github.com/SpiderLabs/ModSecurity/commit/d4d80b38aa85eccb26e3c61b04d16e8ca5de76fe"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=947842"
},
{
"type": "WEB",
"url": "https://github.com/SpiderLabs/ModSecurity/blob/master/CHANGES"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101898.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101911.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102616.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/52847"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/52977"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2013/dsa-2659"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:156"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/04/03/7"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/58810"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-MMQW-R4V3-63Q7
Vulnerability from github – Published: 2025-09-26 21:30 – Updated: 2025-09-26 21:30A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl&style=1. This manipulation causes xml external entity reference. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
{
"affected": [],
"aliases": [
"CVE-2025-11035"
],
"database_specific": {
"cwe_ids": [
"CWE-610",
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-26T19:15:34Z",
"severity": "MODERATE"
},
"details": "A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl\u0026style=1. This manipulation causes xml external entity reference. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.",
"id": "GHSA-mmqw-r4v3-63q7",
"modified": "2025-09-26T21:30:29Z",
"published": "2025-09-26T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11035"
},
{
"type": "WEB",
"url": "https://github.com/frwfxc123/CVE/issues/1"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.325982"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.325982"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.658253"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-MQWP-H5CM-W625
Vulnerability from github – Published: 2026-08-19 15:32 – Updated: 2026-08-19 15:32Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
{
"affected": [],
"aliases": [
"CVE-2026-70423"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-19T14:17:39Z",
"severity": "MODERATE"
},
"details": "Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.",
"id": "GHSA-mqwp-h5cm-w625",
"modified": "2026-08-19T15:32:27Z",
"published": "2026-08-19T15:32:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70423"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000500910/dsa-2026-359-security-update-for-dell-openmanage-enterprise-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MRC5-QWCP-HM9C
Vulnerability from github – Published: 2026-09-15 18:32 – Updated: 2026-09-15 18:32IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resource.
{
"affected": [],
"aliases": [
"CVE-2026-12752"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-15T18:17:15Z",
"severity": "HIGH"
},
"details": "IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resource.",
"id": "GHSA-mrc5-qwcp-hm9c",
"modified": "2026-09-15T18:32:35Z",
"published": "2026-09-15T18:32:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12752"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7285930"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-MRVG-P24W-MP92
Vulnerability from github – Published: 2022-05-13 01:27 – Updated: 2025-04-12 12:47The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.
{
"affected": [],
"aliases": [
"CVE-2015-3451"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-05-12T19:59:00Z",
"severity": "MODERATE"
},
"details": "The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.",
"id": "GHSA-mrvg-p24w-mp92",
"modified": "2025-04-12T12:47:43Z",
"published": "2022-05-13T01:27:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3451"
},
{
"type": "WEB",
"url": "https://bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94640b129ae8930a68a30/raw"
},
{
"type": "WEB",
"url": "http://advisories.mageia.org/MGASA-2015-0199.html"
},
{
"type": "WEB",
"url": "http://cpansearch.perl.org/src/SHLOMIF/XML-LibXML-2.0119/Changes"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157448.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157740.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-09/msg00006.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2015/dsa-3243"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:231"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/04/25/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/04/30/1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/74333"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2592-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-MVHV-28QJ-949C
Vulnerability from github – Published: 2022-05-13 01:34 – Updated: 2022-05-13 01:34A vulnerability in the web-based user interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by convincing a user of an affected system to import a crafted XML file with malicious entries, which could allow the attacker to read and write files within the affected application.
{
"affected": [],
"aliases": [
"CVE-2018-15444"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-08T18:29:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in the web-based user interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by convincing a user of an affected system to import a crafted XML file with malicious entries, which could allow the attacker to read and write files within the affected application.",
"id": "GHSA-mvhv-28qj-949c",
"modified": "2022-05-13T01:34:16Z",
"published": "2022-05-13T01:34:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15444"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-ems-xml-xxe"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2018-36"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/105860"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MWXW-R5FQ-RX8V
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-05-24 19:10Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key.
{
"affected": [],
"aliases": [
"CVE-2021-37425"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-10T22:15:00Z",
"severity": "CRITICAL"
},
"details": "Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key.",
"id": "GHSA-mwxw-r5fq-rx8v",
"modified": "2022-05-24T19:10:48Z",
"published": "2022-05-24T19:10:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37425"
},
{
"type": "WEB",
"url": "https://www.altova.com/mobiletogether"
},
{
"type": "WEB",
"url": "https://www.redteam-pentesting.de/advisories/rt-sa-2021-002"
},
{
"type": "WEB",
"url": "https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/Aug/12"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-MXVX-H4RP-CJRC
Vulnerability from github – Published: 2022-05-13 01:54 – Updated: 2022-05-13 01:54UML Designer version <= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious plugins.xml file.
{
"affected": [],
"aliases": [
"CVE-2018-1000837"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-20T15:29:00Z",
"severity": "CRITICAL"
},
"details": "UML Designer version \u003c= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious plugins.xml file.",
"id": "GHSA-mxvx-h4rp-cjrc",
"modified": "2022-05-13T01:54:14Z",
"published": "2022-05-13T01:54:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000837"
},
{
"type": "WEB",
"url": "https://github.com/ObeoNetwork/UML-Designer/issues/1035"
},
{
"type": "WEB",
"url": "https://0dd.zone/2018/10/28/uml-designer-XXE"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P2HQ-X27F-8MX5
Vulnerability from github – Published: 2022-01-31 00:00 – Updated: 2022-02-05 00:00Signiant Manager+Agents before 15.1 allows XML External Entity (XXE) attacks.
{
"affected": [],
"aliases": [
"CVE-2021-46660"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-30T00:15:00Z",
"severity": "CRITICAL"
},
"details": "Signiant Manager+Agents before 15.1 allows XML External Entity (XXE) attacks.",
"id": "GHSA-p2hq-x27f-8mx5",
"modified": "2022-02-05T00:00:58Z",
"published": "2022-01-31T00:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46660"
},
{
"type": "WEB",
"url": "https://help.signiant.com/flight-deck/general/release-notes-15-1"
},
{
"type": "WEB",
"url": "https://www.signiant.com/technology/security"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-P2JV-394X-276F
Vulnerability from github – Published: 2022-05-17 00:33 – Updated: 2022-05-17 00:33OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to an XML External Entity vulnerability: /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/. An unauthenticated user is able to read directory listings or system files, or cause SSRF or Denial of Service.
{
"affected": [],
"aliases": [
"CVE-2017-14759"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-10-03T01:29:00Z",
"severity": "CRITICAL"
},
"details": "OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to an XML External Entity vulnerability: /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/. An unauthenticated user is able to read directory listings or system files, or cause SSRF or Denial of Service.",
"id": "GHSA-p2jv-394x-276f",
"modified": "2022-05-17T00:33:46Z",
"published": "2022-05-17T00:33:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14759"
},
{
"type": "WEB",
"url": "https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2017/Sep/97"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.