Common Weakness Enumeration

CWE-611

Allowed

Improper Restriction of XML External Entity Reference

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

1697 vulnerabilities reference this CWE, most recent first.

GHSA-73F3-RQQF-2J54

Vulnerability from github – Published: 2026-02-03 18:30 – Updated: 2026-02-03 19:53
VLAI
Summary
Apache Syncope: Console XXE on Keymaster parameters
Details

Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby causing sensitive data leakage occurs.

This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3.

Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.

Severity
4.9 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.syncope.client.idrepo:syncope-client-idrepo-console"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.syncope.client.idrepo:syncope-client-idrepo-console"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23795"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-03T19:53:38Z",
    "nvd_published_at": "2026-02-03T16:16:13Z",
    "severity": "MODERATE"
  },
  "details": "Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby causing sensitive data leakage occurs.\n\nThis issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3.\n\nUsers are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.",
  "id": "GHSA-73f3-rqqf-2j54",
  "modified": "2026-02-03T19:53:38Z",
  "published": "2026-02-03T18:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23795"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/syncope"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/mzgbdn8hzk8vr94o660njcc7w62c2pos"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/02/02/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Syncope: Console XXE on Keymaster parameters"
}

GHSA-744R-VV2G-2X6G

Vulnerability from github – Published: 2019-12-02 18:17 – Updated: 2021-06-15 17:22
VLAI
Summary
Apache NiFi information disclosure by XXE
Details

The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.nifi:nifi-security"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.3.0"
            },
            {
              "fixed": "1.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.nifi:nifi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.3.0"
            },
            {
              "fixed": "1.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-10080"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-12-02T17:27:21Z",
    "nvd_published_at": "2019-11-19T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.",
  "id": "GHSA-744r-vv2g-2x6g",
  "modified": "2021-06-15T17:22:36Z",
  "published": "2019-12-02T18:17:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10080"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/nifi/pull/3507"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://nifi.apache.org/security.html#CVE-2019-10080"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache NiFi information disclosure by XXE"
}

GHSA-74F5-7PJW-4CGF

Vulnerability from github – Published: 2022-05-14 01:37 – Updated: 2022-05-14 01:37
VLAI
Details

In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.

Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-5748"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-01-09T17:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.",
  "id": "GHSA-74f5-7pjw-4cgf",
  "modified": "2022-05-14T01:37:57Z",
  "published": "2022-05-14T01:37:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5748"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traccar/traccar/commit/d7f6c53fd88635885914013649b6807ec53227bf"
    },
    {
      "type": "WEB",
      "url": "https://www.traccar.org/blog"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-74G4-5HCH-J7RM

Vulnerability from github – Published: 2022-05-24 19:09 – Updated: 2022-05-24 19:09
VLAI
Details

XML External Entity vulnerability in Micro Focus Verastream Host Integrator, affecting version 7.8 Update 1 and earlier versions. The vulnerability could allow the control of web browser and hijacking user sessions.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-22523"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-22T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "XML External Entity vulnerability in Micro Focus Verastream Host Integrator, affecting version 7.8 Update 1 and earlier versions. The vulnerability could allow the control of web browser and hijacking user sessions.",
  "id": "GHSA-74g4-5hch-j7rm",
  "modified": "2022-05-24T19:09:02Z",
  "published": "2022-05-24T19:09:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22523"
    },
    {
      "type": "WEB",
      "url": "https://support.microfocus.com/kb/doc.php?id=7025169"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-756F-MJWR-H9X4

Vulnerability from github – Published: 2022-05-14 03:31 – Updated: 2022-05-14 03:31
VLAI
Details

textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web server by exhausting server memory resources. This attack appear to be exploitable via Uploading a specially crafted XML file.

Severity
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-1000090"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-03-13T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web server by exhausting server memory resources. This attack appear to be exploitable via Uploading a specially crafted XML file.",
  "id": "GHSA-756f-mjwr-h9x4",
  "modified": "2022-05-14T03:31:37Z",
  "published": "2022-05-14T03:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000090"
    },
    {
      "type": "WEB",
      "url": "https://github.com/textpattern/textpattern/issues/1141"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7579-Q6RQ-WF6R

Vulnerability from github – Published: 2022-05-24 19:16 – Updated: 2022-05-24 19:16
VLAI
Details

Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are subject to this issue. expat in version 4.1.11 is patched.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-40439"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-10-07T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a \"Billion Laughs\" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are subject to this issue. expat in version 4.1.11 is patched.",
  "id": "GHSA-7579-q6rq-wf6r",
  "modified": "2022-05-24T19:16:54Z",
  "published": "2022-05-24T19:16:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40439"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7cc5fada6d@%3Cannounce.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702%40%3Cusers.openoffice.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702@%3Cusers.openoffice.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2021/10/07/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-75P2-HGW4-G7F7

Vulnerability from github – Published: 2022-05-24 17:12 – Updated: 2023-09-26 20:43
VLAI
Summary
AutoUpdater.NET allows XXE
Details

AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Autoupdater.NET.Official"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-20627"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-18T22:29:18Z",
    "nvd_published_at": "2020-03-23T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.",
  "id": "GHSA-75p2-hgw4-g7f7",
  "modified": "2023-09-26T20:43:47Z",
  "published": "2022-05-24T17:12:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20627"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ravibpatel/AutoUpdater.NET/commit/1dc25f2bea6ea522dbac1512b5563c4746d539c3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ravibpatel/AutoUpdater.NET"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ravibpatel/AutoUpdater.NET/releases/tag/v1.5.8"
    },
    {
      "type": "WEB",
      "url": "https://www.doyler.net/security-not-included/autoupdater-net-vulnerability"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AutoUpdater.NET allows XXE"
}

GHSA-75VW-3M5V-FPRH

Vulnerability from github – Published: 2022-01-21 23:43 – Updated: 2026-04-14 23:55
VLAI
Summary
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
Details

corenlp is vulnerable to Improper Restriction of XML External Entity Reference

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "edu.stanford.nlp:stanford-corenlp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-0239"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-19T15:02:11Z",
    "nvd_published_at": "2022-01-17T07:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "corenlp is vulnerable to Improper Restriction of XML External Entity Reference",
  "id": "GHSA-75vw-3m5v-fprh",
  "modified": "2026-04-14T23:55:03Z",
  "published": "2022-01-21T23:43:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0239"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stanfordnlp/CoreNLP/pull/1242"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stanfordnlp/CoreNLP/commit/f44e693882812b144e09d39850177ff0a1f8d16f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stanfordnlp/corenlp/commit/1940ffb938dc4f3f5bc5f2a2fd8b35aabbbae3dd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/stanfordnlp/corenlp"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/a717aec2-5646-4a5f-ade0-dadc25736ae3"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JAVA-EDUSTANFORDNLP-2342121"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "corenlp is vulnerable to Improper Restriction of XML External Entity Reference"
}

GHSA-763G-FQQ7-48WG

Vulnerability from github – Published: 2020-01-31 18:00 – Updated: 2021-08-19 16:49
VLAI
Summary
XML external entity (XXE) processing ('external-parameter-entities' feature was not fully disabled))
Details

Due to an incomplete fix for CVE-2019-9658, checkstyle was still vulnerable to XML External Entity (XXE) Processing.

Impact

User: Build Maintainers

This vulnerability probably doesn't impact Maven/Gradle users as, in most cases, these builds are processing files that are trusted, or pre-vetted by a pull request reviewer before being run on internal CI infrastructure.

User: Static Analysis as a Service

If you operate a site/service that parses "untrusted" Checkstyle XML configuration files, you are vulnerable to this and should patch.

Note from the discoverer of the original CVE-2019-9658:

While looking at a few companies that run Checkstyle/PMD/ect... as a service I notice that it's a common pattern to run the static code analysis tool inside of a Docker container with the following flags: --net=none \ --privileged=false \ --cap-drop=ALL Running the analysis in Docker has the advantage that there should be no sensitive local file information that XXE can exfiltrate from the container. Additionally, these flags prevent vulnerabilities in static analysis tools like Checkstyle from being used to exfiltrate data via XXE or to perform SSRF. - Jonathan Leitschuh

Patches

Has the problem been patched? What versions should users upgrade to?

Patched, will be released with version 8.29 at 26 Jan 2020.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

No workaround are available

References

For more information

If you have any questions or comments about this advisory: * Open an issue in https://github.com/checkstyle/checkstyle/issues

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.puppycrawl.tools:checkstyle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.29"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-10782"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-01-31T17:58:17Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Due to an incomplete fix for [CVE-2019-9658](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9658), checkstyle was still vulnerable to XML External Entity (XXE) Processing.\n\n### Impact\n\n#### User: Build Maintainers\n\nThis vulnerability probably doesn\u0027t impact Maven/Gradle users as, in most cases, these builds are processing files that are trusted, or pre-vetted by a pull request reviewer before being run on internal CI infrastructure.\n\n#### User: Static Analysis as a Service\n\nIf you operate a site/service that parses \"untrusted\" Checkstyle XML configuration files, you are vulnerable to this and should patch.\n\nNote from the discoverer of the original CVE-2019-9658:\n\n\u003e While looking at a few companies that run Checkstyle/PMD/ect... as a service I notice that it\u0027s a common pattern to run the static code analysis tool inside of a Docker container with the following flags:\n\u003e ```\n\u003e --net=none \\\n\u003e --privileged=false \\\n\u003e --cap-drop=ALL\n\u003e ```\n\u003e Running the analysis in Docker has the advantage that there should be no sensitive local file information that XXE can exfiltrate from the container. Additionally, these flags prevent vulnerabilities in static analysis tools like Checkstyle from being used to exfiltrate data via XXE or to perform SSRF.\n\u003e \\- [Jonathan Leitschuh](https://twitter.com/jlleitschuh)\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nPatched, will be released with version 8.29 at 26 Jan 2020.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nNo workaround are available\n\n### References\n\n - [CWE-611: Improper Restriction of XML External Entity Reference](https://cwe.mitre.org/data/definitions/611.html)\n - GitHub Issue https://github.com/checkstyle/checkstyle/issues/7468\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/checkstyle/checkstyle/issues\n",
  "id": "GHSA-763g-fqq7-48wg",
  "modified": "2021-08-19T16:49:30Z",
  "published": "2020-01-31T18:00:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/checkstyle/checkstyle/security/advisories/GHSA-763g-fqq7-48wg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10782"
    },
    {
      "type": "WEB",
      "url": "https://github.com/checkstyle/checkstyle/issues/7468"
    },
    {
      "type": "WEB",
      "url": "https://github.com/checkstyle/checkstyle/commit/c46a16d177e6797895b195c288ae9a9a096254b8"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r8aaf4ee16bbaf6204731d4770d96ebb34b258cd79b491f9cdd7f2540@%3Ccommits.nifi.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00008.html"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JAVA-COMPUPPYCRAWLTOOLS-543266"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XML external entity (XXE) processing (\u0027external-parameter-entities\u0027 feature was not fully disabled))"
}

GHSA-769G-XF8V-JX9V

Vulnerability from github – Published: 2022-05-24 19:19 – Updated: 2022-05-24 19:19
VLAI
Details

An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consumed by FortiPortal to trigger a denial of service or read arbitrary files from the underlying file system by means of specifically crafted XML documents.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-36172"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-02T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consumed by FortiPortal to trigger a denial of service or read arbitrary files from the underlying file system by means of specifically crafted XML documents.",
  "id": "GHSA-769g-xf8v-jx9v",
  "modified": "2022-05-24T19:19:25Z",
  "published": "2022-05-24T19:19:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36172"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.com/advisory/FG-IR-21-104"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}
Mitigation
Implementation System Configuration

Many XML parsers and validators can be configured to disable external entity expansion.

CAPEC-221: Data Serialization External Entities Blowup

This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.

← Back to the CWE list