CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1822 vulnerabilities reference this CWE, most recent first.
GHSA-88HG-2F8P-PV3W
Vulnerability from github – Published: 2022-04-22 00:24 – Updated: 2023-02-13 06:31The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
{
"affected": [],
"aliases": [
"CVE-2011-3600"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-11-26T01:15:00Z",
"severity": "HIGH"
},
"details": "The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.",
"id": "GHSA-88hg-2f8p-pv3w",
"modified": "2023-02-13T06:31:34Z",
"published": "2022-04-22T00:24:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3600"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2011-3600"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3600"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/7793319ae80ec350f7b82a8763460944f120ebe447f14a12155d0550%40%3Ccommits.ofbiz.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/7793319ae80ec350f7b82a8763460944f120ebe447f14a12155d0550@\u003ccommits.ofbiz.apache.org\u003e"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2011-3600"
},
{
"type": "WEB",
"url": "http://mail-archives.apache.org/mod_mbox/ofbiz-user/201810.mbox/%3Cfad45546-af86-0293-9ea7-014553474b30%40apache.org%3E"
},
{
"type": "WEB",
"url": "http://mail-archives.apache.org/mod_mbox/ofbiz-user/201810.mbox/%3Cfad45546-af86-0293-9ea7-014553474b30@apache.org%3E"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8973-52QV-V8P9
Vulnerability from github – Published: 2022-05-24 16:57 – Updated: 2024-04-04 02:07A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by sending malicious requests to an affected system that contain references in XML entities. A successful exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the application to consume available resources, resulting in a DoS condition.
{
"affected": [],
"aliases": [
"CVE-2019-12711"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-02T19:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by sending malicious requests to an affected system that contain references in XML entities. A successful exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the application to consume available resources, resulting in a DoS condition.",
"id": "GHSA-8973-52qv-v8p9",
"modified": "2024-04-04T02:07:34Z",
"published": "2022-05-24T16:57:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12711"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-cucm-xxe"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-89F8-292W-GFH4
Vulnerability from github – Published: 2025-11-12 18:31 – Updated: 2025-12-15 15:30N-central versions < 2025.4 are vulnerable to an XML External Entities injection leading to information disclosure
{
"affected": [],
"aliases": [
"CVE-2025-11700"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-12T16:15:35Z",
"severity": "HIGH"
},
"details": "N-central versions \u003c 2025.4 are vulnerable to an XML External Entities injection leading to information disclosure",
"id": "GHSA-89f8-292w-gfh4",
"modified": "2025-12-15T15:30:30Z",
"published": "2025-11-12T18:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11700"
},
{
"type": "WEB",
"url": "https://me.n-able.com/s/security-advisory/aArVy0000000rabKAA"
},
{
"type": "WEB",
"url": "https://me.n-able.com/s/security-advisory/aArVy0000000rabKAA/cve202511700-ncentral-importservicefromfile-xxe-injection"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-89X6-9566-CFCX
Vulnerability from github – Published: 2022-05-24 17:48 – Updated: 2024-04-04 03:06An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Orchestration Designer includes all 7.x versions before 7.2.3.
{
"affected": [],
"aliases": [
"CVE-2020-7035"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-23T21:15:00Z",
"severity": "MODERATE"
},
"details": "An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Orchestration Designer includes all 7.x versions before 7.2.3.",
"id": "GHSA-89x6-9566-cfcx",
"modified": "2024-04-04T03:06:25Z",
"published": "2022-05-24T17:48:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7035"
},
{
"type": "WEB",
"url": "https://downloads.avaya.com/css/P8/documents/101075450"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8C3G-H23M-G7WV
Vulnerability from github – Published: 2022-05-14 03:32 – Updated: 2022-05-14 03:32XML external entity (XXE) vulnerability in IBM InfoSphere Information Governance Catalog 11.3 before 11.3.1.2 and 11.5 before 11.5.0.1 allows remote authenticated users to read arbitrary files or cause a denial of service via crafted XML data. IBM X-Force ID: 110510.
{
"affected": [],
"aliases": [
"CVE-2016-0250"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-12T21:29:00Z",
"severity": "MODERATE"
},
"details": "XML external entity (XXE) vulnerability in IBM InfoSphere Information Governance Catalog 11.3 before 11.3.1.2 and 11.5 before 11.5.0.1 allows remote authenticated users to read arbitrary files or cause a denial of service via crafted XML data. IBM X-Force ID: 110510.",
"id": "GHSA-8c3g-h23m-g7wv",
"modified": "2022-05-14T03:32:45Z",
"published": "2022-05-14T03:32:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0250"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/110510"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21977152"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-8C3X-HQ82-GJCM
Vulnerability from github – Published: 2025-01-24 18:33 – Updated: 2026-01-28 23:21Impact
XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where external clients can submit XML.
A previous release provided an incomplete solution revealed by new testing.
Patches
This issue has been patched as of version 1.7.4
Workarounds
None
References
Previous Advisory for Incomplete solution MITRE CWE OWASP XML External Entity Prevention Cheat Sheet
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.hl7.fhir.publisher:org.hl7.fhir.publisher.core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-52807"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2025-01-24T18:33:29Z",
"nvd_published_at": "2025-01-24T19:15:12Z",
"severity": "HIGH"
},
"details": "### Impact\nXSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( ]\u003e could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where external clients can submit XML.\n\nA previous release provided an incomplete solution revealed by new testing. \n\n### Patches\nThis issue has been patched as of version 1.7.4\n\n### Workarounds\nNone\n\n### References\n[Previous Advisory for Incomplete solution](https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5)\n[MITRE CWE](https://cwe.mitre.org/data/definitions/611.html)\n[OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#transformerfactory)",
"id": "GHSA-8c3x-hq82-gjcm",
"modified": "2026-01-28T23:21:27Z",
"published": "2025-01-24T18:33:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5"
},
{
"type": "WEB",
"url": "https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-8c3x-hq82-gjcm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52807"
},
{
"type": "WEB",
"url": "https://github.com/HL7/fhir-ig-publisher/commit/3560de2f486d688a3ddcf4aa54d8bdacea380c3d"
},
{
"type": "PACKAGE",
"url": "https://github.com/HL7/fhir-ig-publisher"
},
{
"type": "WEB",
"url": "https://github.com/HL7/fhir-ig-publisher/compare/1.7.3...1.7.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`"
}
GHSA-8CR8-4VFW-MR7H
Vulnerability from github – Published: 2021-04-30 17:30 – Updated: 2022-08-22 19:43The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "rexml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-28965"
],
"database_specific": {
"cwe_ids": [
"CWE-115",
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-22T16:31:39Z",
"nvd_published_at": "2021-04-21T07:15:00Z",
"severity": "HIGH"
},
"details": "The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing. ",
"id": "GHSA-8cr8-4vfw-mr7h",
"modified": "2022-08-22T19:43:17Z",
"published": "2021-04-30T17:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28965"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/commit/2fe62e29094d95921d7e19abbd2e26b23d78dc5b"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/commit/3c137eb119550874b2b3e27d12b733ca67033377"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/commit/6a250d2cd1194c2be72becbdd9c3e770aa16e752"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/commit/9b311e59ae05749e082eb6bbefa1cb620d1a786e"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/commit/a659c63e37414506dfb0d4655e031bb7a2e73fc8"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/commit/f7bab8937513b1403cea5aff874cbf32fd5e8551"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/commit/f9d88e4948b4a43294c25dc0edb16815bd9d8618"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1104077"
},
{
"type": "PACKAGE",
"url": "https://github.com/ruby/rexml"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2021-28965.yml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT"
},
{
"type": "WEB",
"url": "https://rubygems.org/gems/rexml"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210528-0003"
},
{
"type": "WEB",
"url": "https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "REXML round-trip instability"
}
GHSA-8CXF-788Q-XF3G
Vulnerability from github – Published: 2022-05-13 01:38 – Updated: 2022-05-13 01:38A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file with malicious entries, which could allow the attacker to read and write files and execute remote code within the application. Cisco Bug IDs: CSCvf47946.
{
"affected": [],
"aliases": [
"CVE-2017-12216"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-07T21:29:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file with malicious entries, which could allow the attacker to read and write files and execute remote code within the application. Cisco Bug IDs: CSCvf47946.",
"id": "GHSA-8cxf-788q-xf3g",
"modified": "2022-05-13T01:38:10Z",
"published": "2022-05-13T01:38:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12216"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-socmin"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100664"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039274"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8CXH-WXVQ-9JGW
Vulnerability from github – Published: 2024-07-22 21:30 – Updated: 2024-12-02 18:31Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.
{
"affected": [],
"aliases": [
"CVE-2024-40075"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T19:15:02Z",
"severity": "MODERATE"
},
"details": "Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.",
"id": "GHSA-8cxh-wxvq-9jgw",
"modified": "2024-12-02T18:31:54Z",
"published": "2024-07-22T21:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40075"
},
{
"type": "WEB",
"url": "https://gitee.com/Q16G/laravel_bug/blob/master/laravelBug.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-8F5H-G89Q-H3FX
Vulnerability from github – Published: 2022-05-13 01:35 – Updated: 2022-05-13 01:35A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of the XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by injecting a crafted XML file with malicious entries, which could allow the attacker to read and write files. Cisco Bug IDs: CSCvg19341.
{
"affected": [],
"aliases": [
"CVE-2018-0100"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-18T06:29:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of the XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by injecting a crafted XML file with malicious entries, which could allow the attacker to read and write files. Cisco Bug IDs: CSCvg19341.",
"id": "GHSA-8f5h-g89q-h3fx",
"modified": "2022-05-13T01:35:49Z",
"published": "2022-05-13T01:35:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0100"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-acpe"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102738"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040246"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.