CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1715 vulnerabilities reference this CWE, most recent first.
GHSA-XWQQ-PCG2-PPHR
Vulnerability from github – Published: 2026-04-30 09:30 – Updated: 2026-05-18 00:31Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.
{
"affected": [],
"aliases": [
"CVE-2024-39847"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-30T07:16:36Z",
"severity": "HIGH"
},
"details": "Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.",
"id": "GHSA-xwqq-pcg2-pphr",
"modified": "2026-05-18T00:31:35Z",
"published": "2026-04-30T09:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39847"
},
{
"type": "WEB",
"url": "https://4d.com"
},
{
"type": "WEB",
"url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-002"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2026/May/0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-XX66-M4R3-R5VF
Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-05-24 19:07An XML External Entity (XXE) issue exists in Kaseya VSA before 9.5.6.
{
"affected": [],
"aliases": [
"CVE-2021-30201"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-09T14:15:00Z",
"severity": "HIGH"
},
"details": "An XML External Entity (XXE) issue exists in Kaseya VSA before 9.5.6.",
"id": "GHSA-xx66-m4r3-r5vf",
"modified": "2022-05-24T19:07:22Z",
"published": "2022-05-24T19:07:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30201"
},
{
"type": "WEB",
"url": "https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure"
},
{
"type": "WEB",
"url": "https://csirt.divd.nl/CVE-2021-30201"
},
{
"type": "WEB",
"url": "https://csirt.divd.nl/DIVD-2021-00011"
},
{
"type": "WEB",
"url": "https://helpdesk.kaseya.com/hc/en-gb/articles/360019966738-9-5-6-Feature-Release-8-May-2021"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XX6G-8FH5-HQ6C
Vulnerability from github – Published: 2024-10-09 09:31 – Updated: 2024-10-09 09:31Dell AppSync Server, version 4.3 through 4.6, contains an XML External Entity Injection vulnerability. An adjacent high privileged attacker could potentially exploit this vulnerability, leading to information disclosure.
{
"affected": [],
"aliases": [
"CVE-2024-39586"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-09T07:15:09Z",
"severity": "LOW"
},
"details": "Dell AppSync Server, version 4.3 through 4.6, contains an XML External Entity Injection vulnerability. An adjacent high privileged attacker could potentially exploit this vulnerability, leading to information disclosure.",
"id": "GHSA-xx6g-8fh5-hq6c",
"modified": "2024-10-09T09:31:35Z",
"published": "2024-10-09T09:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39586"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000234216/dsa-2024-420-security-update-for-dell-emc-appsync-for-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XX7G-F287-F9FQ
Vulnerability from github – Published: 2022-05-24 17:29 – Updated: 2023-10-27 11:34Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers able to provide Liquibase changesets evaluated by the plugin to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Jenkins Liquibase Runner Plugin 1.4.7 no longer parses Liquibase changesets.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.4.5"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:liquibase-runner"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2284"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-19T23:52:27Z",
"nvd_published_at": "2020-09-23T14:15:00Z",
"severity": "HIGH"
},
"details": "Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers able to provide Liquibase changesets evaluated by the plugin to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.\n\nJenkins Liquibase Runner Plugin 1.4.7 no longer parses Liquibase changesets.",
"id": "GHSA-xx7g-f287-f9fq",
"modified": "2023-10-27T11:34:49Z",
"published": "2022-05-24T17:29:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2284"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/liquibase-runner-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-1887"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/09/23/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in Jenkins Liquibase Runner Plugin"
}
GHSA-XXP4-HW2V-2VCR
Vulnerability from github – Published: 2022-05-13 01:31 – Updated: 2022-05-13 01:31In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service (not part of the device distribution) could potentially be target of XXE attack due to an improper factory and parser initialisation.
{
"affected": [],
"aliases": [
"CVE-2019-10244"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-04-09T16:29:00Z",
"severity": "HIGH"
},
"details": "In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service (not part of the device distribution) could potentially be target of XXE attack due to an improper factory and parser initialisation.",
"id": "GHSA-xxp4-hw2v-2vcr",
"modified": "2022-05-13T01:31:33Z",
"published": "2022-05-13T01:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10244"
},
{
"type": "WEB",
"url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=545835"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/107844"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.