CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1697 vulnerabilities reference this CWE, most recent first.
GHSA-6WJC-JVCR-HCXW
Vulnerability from github – Published: 2022-05-13 01:23 – Updated: 2022-05-13 01:23perl-XML-Twig: The option to expand_external_ents, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting.
{
"affected": [],
"aliases": [
"CVE-2016-9180"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-12-22T21:59:00Z",
"severity": "CRITICAL"
},
"details": "perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option\u0027s setting.",
"id": "GHSA-6wjc-jvcr-hcxw",
"modified": "2022-05-13T01:23:20Z",
"published": "2022-05-13T01:23:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9180"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00020.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00033.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/11/04/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94219"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6WXG-WH7F-RQPR
Vulnerability from github – Published: 2023-02-16 20:46 – Updated: 2023-04-14 21:35Impact
A XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin in Neo4j graph database. XML External Entity (XXE) injection occurs when the XML parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml procedure was not configured in a secure way and therefore allowed this.
External entities can be used to read local files, send HTTP requests, and perform denial-of-service attacks on the application.
Abusing the XXE vulnerability enabled assessors to read local files remotely. Although with the level of privileges assessors had this was limited to one-line files. With the ability to write to the database, any file could have been read. Additionally, assessors noted, with local testing, the server could be crashed by passing in improperly formatted XML.
Patches
The users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this vulnerability is 5.5.0.
Workarounds
If you cannot upgrade the library, you can control the allowlist of the procedures that can be used in your system.
For more information
If you have any questions or comments about this advisory: * Open an issue in neo4j-apoc * Email us at security@neo4j.com
Credits
We want to publicly recognise the contribution of Christopher Schneider – State Farm.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.neo4j.procedure:apoc-core"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.5.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.neo4j.procedure:apoc-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.4.0.14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-23926"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-16T20:46:49Z",
"nvd_published_at": "2023-02-16T16:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\nA XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin in Neo4j graph database. XML External Entity (XXE) injection occurs when the XML parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml procedure was not configured in a secure way and therefore allowed this. \n\nExternal entities can be used to read local files, send HTTP requests, and perform denial-of-service attacks on the application.\n\nAbusing the XXE vulnerability enabled assessors to read local files remotely. Although with the level of privileges assessors had this was limited to one-line files. With the ability to write to the database, any file could have been read. Additionally, assessors noted, with local testing, the server could be crashed by passing in improperly formatted XML. \n\n### Patches\nThe users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this vulnerability is 5.5.0. \n\n### Workarounds\nIf you cannot upgrade the library, you can control the\u00a0[allowlist](https://neo4j.com/docs/operations-manual/current/reference/configuration-settings/#config_dbms.security.procedures.allowlist) of the procedures\u00a0that can be used in your system.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in\u00a0[neo4j-apoc](https://github.com/neo4j/apoc)\n* Email us at\u00a0[security@neo4j.com](mailto:security@neo4j.com)\n\n### Credits\nWe want to publicly recognise the contribution of Christopher Schneider \u2013 State Farm.\n",
"id": "GHSA-6wxg-wh7f-rqpr",
"modified": "2023-04-14T21:35:17Z",
"published": "2023-02-16T20:46:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/neo4j/apoc/security/advisories/GHSA-6wxg-wh7f-rqpr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23926"
},
{
"type": "WEB",
"url": "https://github.com/neo4j/apoc/pull/310"
},
{
"type": "WEB",
"url": "https://github.com/neo4j/apoc/commit/f175f1f1f663d29fc151c297b56d154255eb7016"
},
{
"type": "PACKAGE",
"url": "https://github.com/neo4j/apoc"
},
{
"type": "WEB",
"url": "https://github.com/neo4j/apoc/releases/tag/5.5.0"
},
{
"type": "WEB",
"url": "https://neo4j.com/docs/operations-manual/current/reference/configuration-settings/#config_dbms.security.procedures.allowlist"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "XML External Entity (XXE) vulnerability in apoc.import.graphml"
}
GHSA-6X4W-8W53-XRVV
Vulnerability from github – Published: 2020-09-14 18:44 – Updated: 2020-09-14 18:42Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) or (2) JSTL XML tag.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.taglibs:taglibs-standard"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.taglibs:taglibs-standard-impl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-0254"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-09-14T18:42:48Z",
"nvd_published_at": "2015-03-09T14:59:00Z",
"severity": "HIGH"
},
"details": "Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) \u003cx:parse\u003e or (2) \u003cx:transform\u003e JSTL XML tag.",
"id": "GHSA-6x4w-8w53-xrvv",
"modified": "2020-09-14T18:42:48Z",
"published": "2020-09-14T18:44:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0254"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1376"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/8a20e48acb2a40be5130df91cf9d39d8ad93181989413d4abcaa4914@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r6c93d8ade3788dbc00f5a37238bc278e7d859f2446b885460783a16f@%3Cpluto-dev.portals.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rc1686f6196bb9063bf26577a21b8033c19c1a30e5a9159869c8f3d38@%3Cpluto-dev.portals.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf1179e6971bc46f0f68879a9a10cc97ad4424451b0889aeef04c8077@%3Cpluto-scm.portals.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rfc2bfd99c340dafd501676693cd889c1f9f838b97bdd0776a8f5557d@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-10/msg00033.html"
},
{
"type": "WEB",
"url": "http://mail-archives.apache.org/mod_mbox/tomcat-taglibs-user/201502.mbox/%3C82207A16-6348-4DEE-877E-F7B87292576A%40apache.org%3E"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/130575/Apache-Standard-Taglibs-1.2.1-XXE-Remote-Command-Execution.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1695.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1838.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1839.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1840.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1841.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/534772/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/72809"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1034934"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2551-1"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "XXE in Apache Standard Taglibs"
}
GHSA-6XM7-3CC5-47F9
Vulnerability from github – Published: 2022-09-08 00:00 – Updated: 2022-09-16 17:19DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mei2volpiano"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.8.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-37189"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-16T17:19:30Z",
"nvd_published_at": "2022-09-07T13:15:00Z",
"severity": "HIGH"
},
"details": "DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe \u0027xml.etree\u0027 library to parse untrusted XML input.",
"id": "GHSA-6xm7-3cc5-47f9",
"modified": "2022-09-16T17:19:30Z",
"published": "2022-09-08T00:00:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37189"
},
{
"type": "WEB",
"url": "https://docs.python.org/3/library/xml.html#xml-vulnerabilities"
},
{
"type": "WEB",
"url": "https://github.com/DDMAL/MEI2Volpiano"
},
{
"type": "WEB",
"url": "https://github.com/DDMAL/MEI2Volpiano/blob/987b70fff991235e682405f901388af0f414eaa8/mei2volpiano/mei2volpiano.py#L59"
},
{
"type": "WEB",
"url": "https://pyup.io/vulnerabilities/CVE-2022-37189/50928"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)"
}
GHSA-6XMX-H98X-6VXG
Vulnerability from github – Published: 2022-05-24 17:47 – Updated: 2022-05-24 17:47XML External Entity Resolution (XXE) in Helix ALM. The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software components, leading to XXE attacks.
{
"affected": [],
"aliases": [
"CVE-2021-29997"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-13T17:15:00Z",
"severity": "CRITICAL"
},
"details": "XML External Entity Resolution (XXE) in Helix ALM. The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software components, leading to XXE attacks.",
"id": "GHSA-6xmx-h98x-6vxg",
"modified": "2022-05-24T17:47:29Z",
"published": "2022-05-24T17:47:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29997"
},
{
"type": "WEB",
"url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2021-29997"
},
{
"type": "WEB",
"url": "https://support2.windriver.com/index.php?page=security-notices"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6XQ3-JGFV-2JH3
Vulnerability from github – Published: 2025-04-08 15:31 – Updated: 2025-04-08 15:31An XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch and parse the XML response.
{
"affected": [],
"aliases": [
"CVE-2025-32406"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-08T15:15:50Z",
"severity": "MODERATE"
},
"details": "An XXE issue in the Director NBR component in NAKIVO Backup \u0026 Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch and parse the XML response.",
"id": "GHSA-6xq3-jgfv-2jh3",
"modified": "2025-04-08T15:31:06Z",
"published": "2025-04-08T15:31:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32406"
},
{
"type": "WEB",
"url": "https://helpcenter.nakivo.com/Knowledge-Base/Content/Security-Advisory/CVE-2025-32406.htm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6XQ8-PVG4-3MF3
Vulnerability from github – Published: 2018-10-19 16:54 – Updated: 2025-10-15 16:43Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.rdf4j:rdf4j-runtime"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1000644"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:20:48Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Eclipse RDF4j version \u003c 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.",
"id": "GHSA-6xq8-pvg4-3mf3",
"modified": "2025-10-15T16:43:16Z",
"published": "2018-10-19T16:54:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000644"
},
{
"type": "WEB",
"url": "https://github.com/eclipse/rdf4j/issues/1056"
},
{
"type": "WEB",
"url": "https://0dd.zone/2018/08/05/rdf4j-XXE"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-6xq8-pvg4-3mf3"
},
{
"type": "PACKAGE",
"url": "https://github.com/eclipse/rdf4j"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Eclipse RDF4j vulnerable to XML External Entity"
}
GHSA-728W-FQ42-M52C
Vulnerability from github – Published: 2025-04-17 00:30 – Updated: 2025-04-17 00:30Overview
XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g. in an error message), thereby exposing the file contents. (CWE-611)
Description
Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.2, including 9.3.x and 8.3.x, do not correctly protect Pentaho Data Integration MessageSourceCrawler against out-of-band XML External Entity Reference.
Impact
By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. Using URIs with other schemes such as http://, the attacker can force the application to make outgoing requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions or hide the source of attacks such as port scanning.
{
"affected": [],
"aliases": [
"CVE-2025-24910"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T23:15:45Z",
"severity": "MODERATE"
},
"details": "Overview \n\n\n\n\u00a0\n\n\n\nXML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g. in an error message), thereby exposing the file contents. (CWE-611) \n\n\n\n\u00a0\n\n\n\nDescription \n\n\n\n\u00a0\n\n\n\nHitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.2, including 9.3.x and 8.3.x, do not correctly protect Pentaho Data Integration MessageSourceCrawler against out-of-band XML External Entity Reference. \n\n\n\n\u00a0\n\n\n\nImpact \n\n\n\n\u00a0\n\n\n\nBy submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. Using URIs with other schemes such as http://, the attacker can force the application to make outgoing requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions or hide the source of attacks such as port scanning.",
"id": "GHSA-728w-fq42-m52c",
"modified": "2025-04-17T00:30:26Z",
"published": "2025-04-17T00:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24910"
},
{
"type": "WEB",
"url": "https://support.pentaho.com/hc/en-us/articles/35782683750541--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Restriction-of-XML-External-Entity-Reference-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-24910"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-732F-W585-GMPC
Vulnerability from github – Published: 2022-05-24 19:05 – Updated: 2023-10-27 15:23Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers with the ability to call webhooks configured to extract parameters using XPath to have Jenkins parse a crafted XML request body that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Jenkins Generic Webhook Trigger Plugin 1.74 disables external entity resolution for its XML parser.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.72"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:generic-webhook-trigger"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.74"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21669"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-08-26T16:28:18Z",
"nvd_published_at": "2021-06-18T10:15:00Z",
"severity": "CRITICAL"
},
"details": "Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers with the ability to call webhooks configured to extract parameters using XPath to have Jenkins parse a crafted XML request body that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.\n\nJenkins Generic Webhook Trigger Plugin 1.74 disables external entity resolution for its XML parser.",
"id": "GHSA-732f-w585-gmpc",
"modified": "2023-10-27T15:23:32Z",
"published": "2022-05-24T19:05:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21669"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/generic-webhook-trigger-plugin/commit/da434dfca1b82f5de81e29438762370d652493b8"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/generic-webhook-trigger-plugin"
},
{
"type": "WEB",
"url": "https://plugins.jenkins.io/generic-webhook-trigger/#dependencies"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2021-06-18/#SECURITY-2330"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/06/18/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in Jenkins Generic Webhook Trigger Plugin"
}
GHSA-7358-GHCM-C3FF
Vulnerability from github – Published: 2022-09-13 00:00 – Updated: 2022-09-16 00:00Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20, 2022. The XML parser in the Policy Engine was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. This issue affects: Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2. Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2. Forcepoint Web Security Content Gateway versions prior to 8.5.5. Forcepoint Email Security with DLP enabled versions prior to 8.5.5. Forcepoint Cloud Security Gateway prior to June 20, 2022.
{
"affected": [],
"aliases": [
"CVE-2022-1700"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-12T19:15:00Z",
"severity": "CRITICAL"
},
"details": "Improper Restriction of XML External Entity Reference (\u0027XXE\u0027) vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20, 2022. The XML parser in the Policy Engine was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. This issue affects: Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2. Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2. Forcepoint Web Security Content Gateway versions prior to 8.5.5. Forcepoint Email Security with DLP enabled versions prior to 8.5.5. Forcepoint Cloud Security Gateway prior to June 20, 2022.",
"id": "GHSA-7358-ghcm-c3ff",
"modified": "2022-09-16T00:00:33Z",
"published": "2022-09-13T00:00:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1700"
},
{
"type": "WEB",
"url": "https://help.forcepoint.com/security/CVE/CVE-2022-1700.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.