Common Weakness Enumeration

CWE-611

Allowed

Improper Restriction of XML External Entity Reference

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

1817 vulnerabilities reference this CWE, most recent first.

GHSA-2JX3-P89P-3F69

Vulnerability from github – Published: 2022-12-21 18:30 – Updated: 2022-12-21 18:30
VLAI
Details

An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-25628"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-16T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4",
  "id": "GHSA-2jx3-p89p-3f69",
  "modified": "2022-12-21T18:30:24Z",
  "published": "2022-12-21T18:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25628"
    },
    {
      "type": "WEB",
      "url": "https://support.broadcom.com/external/content/SecurityAdvisories/0/21136"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2JX8-V4HV-GX3H

Vulnerability from github – Published: 2021-06-28 16:45 – Updated: 2021-10-05 17:29
VLAI
Summary
XXE vulnerability in Launch import
Details
Release Date Affected Projects Affected Versions Access Vector Security Risk
Monday, May 4, 2020 service-api Every version, starting from 3.1.0 Remote Medium

Impact

Starting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file that uses external entities for extraction of secrets from Report Portal service-api module or server-side request forgery.

Report Portal versions 4.3.12+ and 5.1.1+ disables external entity resolution for theirs XML parser.

We advise our users install the latest releases we built specifically to address this issue.

Patches

Fixed with https://github.com/reportportal/service-api/pull/1201

Binary Download

https://bintray.com/epam/reportportal/service-api/5.1.1 https://bintray.com/epam/reportportal/service-api/4.3.12

Docker Container Download

  • RP v4: docker pull reportportal/service-api:4.3.12
  • RP v5: docker pull reportportal/service-api:5.1.1

Acknowledgement

The issue was reported to Report Portal Team by an external security researcher. Our Team thanks Julien M. for reporting the issue.

For more information

If you have any questions or comments about this advisory email us: support@reportportal.io

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.epam.reportportal:service-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "4.3.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.epam.reportportal:service-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-12642"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-06-28T16:45:26Z",
    "nvd_published_at": "2020-05-04T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "| Release Date | Affected Projects | Affected Versions | Access Vector| Security Risk |\n|--------------|-------------------|-------------------|---------------|---------------|\n| Monday, May 4, 2020| [service-api](https://github.com/reportportal/service-api) | Every version, starting from 3.1.0 | Remote | Medium |\n\n### Impact\nStarting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file that uses external entities for extraction of secrets from Report Portal service-api module or server-side request forgery.\n\nReport Portal versions 4.3.12+ and 5.1.1+ disables external entity resolution for theirs XML parser.\n\nWe advise our users install the latest releases we built specifically to address this issue.\n\n### Patches\nFixed with https://github.com/reportportal/service-api/pull/1201\n\n### Binary Download\nhttps://bintray.com/epam/reportportal/service-api/5.1.1\nhttps://bintray.com/epam/reportportal/service-api/4.3.12\n\n### Docker Container Download\n* RP v4: `docker pull reportportal/service-api:4.3.12`\n* RP v5: `docker pull reportportal/service-api:5.1.1`\n\n### Acknowledgement\nThe issue was reported to Report Portal Team by an external security researcher.\nOur Team thanks Julien M. for reporting the issue.\n\n### For more information\nIf you have any questions or comments about this advisory email us: [support@reportportal.io](mailto:support@reportportal.io)",
  "id": "GHSA-2jx8-v4hv-gx3h",
  "modified": "2021-10-05T17:29:41Z",
  "published": "2021-06-28T16:45:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/reportportal/reportportal/security/advisories/GHSA-2jx8-v4hv-gx3h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12642"
    },
    {
      "type": "WEB",
      "url": "https://github.com/reportportal/service-api/pull/1201"
    },
    {
      "type": "WEB",
      "url": "https://github.com/reportportal/service-api/commit/da4a012abdcc69f02f4255d81466f1f473b7f418"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/reportportal/reportportal"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XXE vulnerability in Launch import"
}

GHSA-2M3G-74X3-7W8X

Vulnerability from github – Published: 2025-12-10 00:30 – Updated: 2025-12-10 00:30
VLAI
Details

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A high privileged attacker could exploit this vulnerability to access sensitive files and data on the server. Exploitation of this issue requires user interaction and scope is changed.

Severity
6.2 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-61823"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-10T00:16:10Z",
    "severity": "MODERATE"
  },
  "details": "ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference (\u0027XXE\u0027) vulnerability that could lead to arbitrary file system read. A high privileged attacker could exploit this vulnerability to access sensitive files and data on the server. Exploitation of this issue requires user interaction and scope is changed.",
  "id": "GHSA-2m3g-74x3-7w8x",
  "modified": "2025-12-10T00:30:23Z",
  "published": "2025-12-10T00:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61823"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2MP8-QVQM-3XWQ

Vulnerability from github – Published: 2018-10-17 00:04 – Updated: 2023-09-26 11:23
VLAI
Summary
Restlet Framework Ja-rs extension is vulnerable to XXE when using SimpleXMLProvider
Details

Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request. This affects use of the Jax-rs extension.

Severity
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.restlet.jse:org.restlet.ext.jaxrs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2017-14868"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:52:36Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request. This affects use of the Jax-rs extension.",
  "id": "GHSA-2mp8-qvqm-3xwq",
  "modified": "2023-09-26T11:23:36Z",
  "published": "2018-10-17T00:04:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14868"
    },
    {
      "type": "WEB",
      "url": "https://github.com/restlet/restlet-framework-java/issues/1286"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-2mp8-qvqm-3xwq"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/restlet/restlet-framework-java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements"
    },
    {
      "type": "WEB",
      "url": "https://lgtm.com/blog/restlet_CVE-2017-14868"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Restlet Framework Ja-rs extension is vulnerable to XXE when using SimpleXMLProvider"
}

GHSA-2MPF-M756-HXJM

Vulnerability from github – Published: 2026-06-11 09:31 – Updated: 2026-08-21 19:13
VLAI
Summary
Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource
Details

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.0.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.ws:spring-xml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.1.3"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.ws:spring-xml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.ws:spring-xml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "last_affected": "4.0.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.ws:spring-xml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "last_affected": "3.1.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40998"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-21T19:13:08Z",
    "nvd_published_at": "2026-06-11T07:16:27Z",
    "severity": "HIGH"
  },
  "details": "Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK\u0027s default DocumentBuilderFactory behavior instead of Spring\u0027s hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.\n\nAffected versions:\nSpring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.",
  "id": "GHSA-2mpf-m756-hxjm",
  "modified": "2026-08-21T19:13:08Z",
  "published": "2026-06-11T09:31:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40998"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spring-projects/spring-ws/commit/eb8d66c0995d1e1dd5bfcfb657c8c9de21266d97"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spring-projects/spring-ws"
    },
    {
      "type": "WEB",
      "url": "https://spring.io/security/cve-2026-40998"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource"
}

GHSA-2P2J-5CRH-G4RM

Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2024-01-13 06:30
VLAI
Details

An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-15352"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-10-27T05:15:00Z",
    "severity": "HIGH"
  },
  "details": "An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.",
  "id": "GHSA-2p2j-5crh-g4rm",
  "modified": "2024-01-13T06:30:23Z",
  "published": "2022-05-24T17:32:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15352"
    },
    {
      "type": "WEB",
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2P76-GC46-5FVC

Vulnerability from github – Published: 2025-06-10 20:10 – Updated: 2025-06-10 20:10
VLAI
Summary
GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint
Details

Impact

GeoNetwork WFS Index functionality is affected by GeoTools XML External Entity (XXE) vulnerability during schema validation.

This vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files

Patches

GeoNetwork 4.4.8 / 4.2.13.

Workarounds

Remove the gn-wfsfeature-harvester and gn-camelPeriodicProducer jars, disabling the WFS Index functionality.

References

  • GHSA-826p-4gcg-35vw
  • https://github.com/geonetwork/core-geonetwork/pull/8757
  • https://github.com/geonetwork/core-geonetwork/pull/8803
  • https://github.com/geonetwork/core-geonetwork/pull/8812
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.4.7"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.geonetwork-opensource:gn-web-app"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.4.0"
            },
            {
              "fixed": "4.4.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.2.12"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.geonetwork-opensource:gn-web-app"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0"
            },
            {
              "fixed": "4.2.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.4.7"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.geonetwork-opensource:gn-wfsfeature-harvester"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.4.0"
            },
            {
              "fixed": "4.4.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.2.12"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.geonetwork-opensource:gn-wfsfeature-harvester"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0"
            },
            {
              "fixed": "4.2.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-611",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-10T20:10:42Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nGeoNetwork WFS Index functionality is affected by GeoTools XML External Entity (XXE) vulnerability during schema validation. \n\nThis vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files \n\n### Patches\n\nGeoNetwork 4.4.8 / 4.2.13.\n\n### Workarounds\n\nRemove the ``gn-wfsfeature-harvester`` and ``gn-camelPeriodicProducer``  jars, disabling the WFS Index functionality. \n\n### References\n\n- [GHSA-826p-4gcg-35vw](https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw)\n- https://github.com/geonetwork/core-geonetwork/pull/8757\n- https://github.com/geonetwork/core-geonetwork/pull/8803\n- https://github.com/geonetwork/core-geonetwork/pull/8812",
  "id": "GHSA-2p76-gc46-5fvc",
  "modified": "2025-06-10T20:10:42Z",
  "published": "2025-06-10T20:10:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geonetwork/core-geonetwork/pull/8757"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geonetwork/core-geonetwork/pull/8803"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geonetwork/core-geonetwork/pull/8812"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/geonetwork/core-geonetwork"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint"
}

GHSA-2P7R-HC45-R2QC

Vulnerability from github – Published: 2022-05-14 01:05 – Updated: 2025-04-20 03:46
VLAI
Details

The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.

Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2014-0030"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-10-10T01:30:00Z",
    "severity": "CRITICAL"
  },
  "details": "The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.",
  "id": "GHSA-2p7r-hc45-r2qc",
  "modified": "2025-04-20T03:46:26Z",
  "published": "2022-05-14T01:05:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0030"
    },
    {
      "type": "WEB",
      "url": "https://liftsecurity.io/advisories/Apache_Roller_XML-RPC_susceptible_to_XXE"
    },
    {
      "type": "WEB",
      "url": "https://mail-archives.apache.org/mod_mbox/roller-dev/201401.mbox/%3CCAF1aazCMzDGB12Ls4t-SOwNA=OdguD010LX3yZGhk2GQHafFXw%40mail.gmail.com%3E"
    },
    {
      "type": "WEB",
      "url": "https://mail-archives.apache.org/mod_mbox/roller-dev/201401.mbox/%3CCAF1aazCMzDGB12Ls4t-SOwNA=OdguD010LX3yZGhk2GQHafFXw@mail.gmail.com%3E"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/45341"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2P7X-C866-R9JV

Vulnerability from github – Published: 2022-05-17 05:48 – Updated: 2024-02-21 21:30
VLAI
Details

The XML parser in Splunk 4.0.0 through 4.1.4 allows remote authenticated users to obtain sensitive information and gain privileges via an XML External Entity (XXE) attack to unknown vectors.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2010-3322"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2010-09-14T17:00:00Z",
    "severity": "MODERATE"
  },
  "details": "The XML parser in Splunk 4.0.0 through 4.1.4 allows remote authenticated users to obtain sensitive information and gain privileges via an XML External Entity (XXE) attack to unknown vectors.",
  "id": "GHSA-2p7x-c866-r9jv",
  "modified": "2024-02-21T21:30:21Z",
  "published": "2022-05-17T05:48:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3322"
    },
    {
      "type": "WEB",
      "url": "http://www.splunk.com/view/SP-CAAAFQ6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2P96-WHQ9-48CC

Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32
VLAI
Details

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 146189.

Severity
7.1 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-1702"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-09-28T13:29:00Z",
    "severity": "HIGH"
  },
  "details": "IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 146189.",
  "id": "GHSA-2p96-whq9-48cc",
  "modified": "2022-05-13T01:32:56Z",
  "published": "2022-05-13T01:32:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1702"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/146189"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/docview.wss?uid=ibm10719659"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Implementation System Configuration

Many XML parsers and validators can be configured to disable external entity expansion.

CAPEC-221: Data Serialization External Entities Blowup

This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.

← Back to the CWE list