CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1831 vulnerabilities reference this CWE, most recent first.
GHSA-W4FH-4PM9-QPFQ
Vulnerability from github – Published: 2022-06-15 00:00 – Updated: 2022-06-28 00:00An XML external entity (XXE) injection vulnerability in Magicpin v3.4 allows attackers to access sensitive database information via a crafted SVG file.
{
"affected": [],
"aliases": [
"CVE-2022-31447"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-14T03:15:00Z",
"severity": "HIGH"
},
"details": "An XML external entity (XXE) injection vulnerability in Magicpin v3.4 allows attackers to access sensitive database information via a crafted SVG file.",
"id": "GHSA-w4fh-4pm9-qpfq",
"modified": "2022-06-28T00:00:57Z",
"published": "2022-06-15T00:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31447"
},
{
"type": "WEB",
"url": "https://gist.github.com/Mr-Akuma/4f6261007fcfbd96fa2c2d8ad4a5e1ca"
},
{
"type": "WEB",
"url": "https://magicpin.in"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W4G6-8XQP-G92M
Vulnerability from github – Published: 2023-04-02 21:30 – Updated: 2023-04-10 16:27Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers able to control coverage report file contents for the Post to Phabricator post-build action to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:phabricator-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-28683"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-04-03T22:55:58Z",
"nvd_published_at": "2023-04-02T21:15:00Z",
"severity": "HIGH"
},
"details": "Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers able to control coverage report file contents for the `Post to Phabricator` post-build action to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.",
"id": "GHSA-w4g6-8xqp-g92m",
"modified": "2023-04-10T16:27:13Z",
"published": "2023-04-02T21:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28683"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/phabricator-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2942"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Phabricator Differential Plugin vulnerable to XML external entity (XXE) attacks"
}
GHSA-W53R-J3P6-Q2W6
Vulnerability from github – Published: 2022-05-24 16:47 – Updated: 2024-04-04 00:53Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external entity (XXE) injection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to read arbitrary server system files by supplying specially crafted document type definitions (DTDs) in an XML request.
{
"affected": [],
"aliases": [
"CVE-2019-3722"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-06T19:29:00Z",
"severity": "HIGH"
},
"details": "Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external entity (XXE) injection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to read arbitrary server system files by supplying specially crafted document type definitions (DTDs) in an XML request.",
"id": "GHSA-w53r-j3p6-q2w6",
"modified": "2024-04-04T00:53:30Z",
"published": "2022-05-24T16:47:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3722"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/article/us/en/04/sln317441/dsa-2019-074-dell-emc-openmanage-server-administrator-multiple-vulnerabilities?lang=en"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/108685"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W56W-4253-9GGG
Vulnerability from github – Published: 2022-05-24 17:44 – Updated: 2022-05-24 17:44/exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser.
{
"affected": [],
"aliases": [
"CVE-2021-28110"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-19T04:15:00Z",
"severity": "HIGH"
},
"details": "/exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser.",
"id": "GHSA-w56w-4253-9ggg",
"modified": "2022-05-24T17:44:57Z",
"published": "2022-05-24T17:44:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28110"
},
{
"type": "WEB",
"url": "https://gist.github.com/kukuxumushi/0b7d90a917ac3480066c4cbf7519b40a"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-W5J2-H9QX-GW8Q
Vulnerability from github – Published: 2022-05-13 01:31 – Updated: 2022-05-13 01:31External Entity Attack vulnerability in the ePO extension in McAfee Common UI (CUI) 2.0.2 allows remote authenticated users to view confidential information via a crafted HTTP request parameter.
{
"affected": [],
"aliases": [
"CVE-2018-6670"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-07T18:29:00Z",
"severity": "MODERATE"
},
"details": "External Entity Attack vulnerability in the ePO extension in McAfee Common UI (CUI) 2.0.2 allows remote authenticated users to view confidential information via a crafted HTTP request parameter.",
"id": "GHSA-w5j2-h9qx-gw8q",
"modified": "2022-05-13T01:31:58Z",
"published": "2022-05-13T01:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6670"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10236"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W6P8-6MFR-RC8P
Vulnerability from github – Published: 2022-05-14 01:11 – Updated: 2022-05-14 01:11A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0791, CVE-2019-0792, CVE-2019-0793, CVE-2019-0795.
{
"affected": [],
"aliases": [
"CVE-2019-0790"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-04-09T21:29:00Z",
"severity": "HIGH"
},
"details": "A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka \u0027MS XML Remote Code Execution Vulnerability\u0027. This CVE ID is unique from CVE-2019-0791, CVE-2019-0792, CVE-2019-0793, CVE-2019-0795.",
"id": "GHSA-w6p8-6mfr-rc8p",
"modified": "2022-05-14T01:11:02Z",
"published": "2022-05-14T01:11:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0790"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0790"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/107702"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W6X6-JQMR-MMC8
Vulnerability from github – Published: 2022-05-17 02:53 – Updated: 2022-05-17 02:53NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to local file disclosure via an XML External Entity (XXE) attack.
{
"affected": [],
"aliases": [
"CVE-2016-5749"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-23T06:59:00Z",
"severity": "MODERATE"
},
"details": "NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to local file disclosure via an XML External Entity (XXE) attack.",
"id": "GHSA-w6x6-jqmr-mmc8",
"modified": "2022-05-17T02:53:42Z",
"published": "2022-05-17T02:53:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5749"
},
{
"type": "WEB",
"url": "https://www.novell.com/support/kb/doc.php?id=7017806"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W7G4-247X-PRX9
Vulnerability from github – Published: 2026-09-24 00:30 – Updated: 2026-09-24 00:30IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.
{
"affected": [],
"aliases": [
"CVE-2026-81536"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-23T22:16:57Z",
"severity": "HIGH"
},
"details": "IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.",
"id": "GHSA-w7g4-247x-prx9",
"modified": "2026-09-24T00:30:25Z",
"published": "2026-09-24T00:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81536"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7288649"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W898-3PH8-5PGM
Vulnerability from github – Published: 2022-05-24 16:44 – Updated: 2023-10-26 21:42Jenkins Swarm Plugin allows clients to auto-discover Jenkins instances on the same network through a UDP discovery request. Responses to this request are XML documents.
Swarm Plugin does not configure the XML parser in a way that would prevent XML External Entity (XXE) processing. This allows unauthenticated attackers on the same network to have Swarm clients parse a maliciously crafted XML response that uses external entities to read arbitrary files from the Swarm client or denial-of-service attacks.
As of publication of this advisory, there is no fix.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:swarm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-10309"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-26T21:42:04Z",
"nvd_published_at": "2019-04-30T13:29:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Swarm Plugin allows clients to auto-discover Jenkins instances on the same network through a UDP discovery request. Responses to this request are XML documents.\n\nSwarm Plugin does not configure the XML parser in a way that would prevent XML External Entity (XXE) processing. This allows unauthenticated attackers on the same network to have Swarm clients parse a maliciously crafted XML response that uses external entities to read arbitrary files from the Swarm client or denial-of-service attacks.\n\nAs of publication of this advisory, there is no fix.",
"id": "GHSA-w898-3ph8-5pgm",
"modified": "2023-10-26T21:42:04Z",
"published": "2022-05-24T16:44:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10309"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1252"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200227073756/http://www.securityfocus.com/bid/108159"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0783"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/04/30/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Self-Organizing Swarm Plug-in Modules Plugin XXE vulnerability via UDP broadcast response"
}
GHSA-W89V-55CW-2PM8
Vulnerability from github – Published: 2022-05-24 16:52 – Updated: 2024-04-04 01:31cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).
{
"affected": [],
"aliases": [
"CVE-2017-18438"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-02T17:15:00Z",
"severity": "MODERATE"
},
"details": "cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).",
"id": "GHSA-w89v-55cw-2pm8",
"modified": "2024-04-04T01:31:10Z",
"published": "2022-05-24T16:52:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18438"
},
{
"type": "WEB",
"url": "https://documentation.cpanel.net/display/CL/64+Change+Log"
},
{
"type": "WEB",
"url": "https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.