CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1696 vulnerabilities reference this CWE, most recent first.
GHSA-9V77-4QPM-W3GC
Vulnerability from github – Published: 2024-05-03 03:30 – Updated: 2024-05-03 03:30LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of the copyContent command. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-20006.
{
"affected": [],
"aliases": [
"CVE-2023-40507"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T03:15:25Z",
"severity": "HIGH"
},
"details": "LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the copyContent command. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-20006.",
"id": "GHSA-9v77-4qpm-w3gc",
"modified": "2024-05-03T03:30:59Z",
"published": "2024-05-03T03:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40507"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1211"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9VF5-WQH5-QMX4
Vulnerability from github – Published: 2022-06-22 00:00 – Updated: 2022-06-29 00:00XML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs.
{
"affected": [],
"aliases": [
"CVE-2021-40510"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-21T17:15:00Z",
"severity": "HIGH"
},
"details": "XML eXternal Entity (XXE) in OBDA systems\u2019 Mastro 1.0 allows remote attackers to read system files via custom DTDs.",
"id": "GHSA-9vf5-wqh5-qmx4",
"modified": "2022-06-29T00:00:25Z",
"published": "2022-06-22T00:00:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40510"
},
{
"type": "WEB",
"url": "https://www.cyberiskvision.com/advisory"
},
{
"type": "WEB",
"url": "https://www.obdasystems.com/mastro"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9VPM-FW8C-289M
Vulnerability from github – Published: 2022-05-24 17:05 – Updated: 2024-04-04 02:45Xiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php.
{
"affected": [],
"aliases": [
"CVE-2019-19998"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-26T04:15:00Z",
"severity": "HIGH"
},
"details": "Xiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php.",
"id": "GHSA-9vpm-fw8c-289m",
"modified": "2024-04-04T02:45:24Z",
"published": "2022-05-24T17:05:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19998"
},
{
"type": "WEB",
"url": "https://gitee.com/xiuno/xiunobbs/issues/I177MY"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9VRQ-QPRH-6WVG
Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2022-12-03 00:30IBM Security Guardium Big Data Intelligence 4.0 (SonarG) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 161419.
{
"affected": [],
"aliases": [
"CVE-2019-4340"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-20T20:15:00Z",
"severity": "HIGH"
},
"details": "IBM Security Guardium Big Data Intelligence 4.0 (SonarG) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 161419.",
"id": "GHSA-9vrq-qprh-6wvg",
"modified": "2022-12-03T00:30:20Z",
"published": "2022-05-24T16:54:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4340"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/161419"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10960856"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-9VX8-F5C4-862X
Vulnerability from github – Published: 2023-02-24 17:39 – Updated: 2023-03-31 14:27Impact
A XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin in Neo4j graph database. XML External Entity (XXE) injection occurs when the XML parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml procedure was not configured in a secure way and therefore allowed this.
External entities can be used to read local files, send HTTP requests, and perform denial-of-service attacks on the application.
Abusing the XXE vulnerability enabled assessors to read local files remotely. Although with the level of privileges assessors had this was limited to one-line files. With the ability to write to the database, any file could have been read. Additionally, assessors noted, with local testing, the server could be crashed by passing in improperly formatted XML.
Patches
The users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this vulnerability is 4.4.0.14.
Workarounds
If you cannot upgrade the library, you can control the allowlist of the procedures that can be used in your system.
For more information
If you have any questions or comments about this advisory: * Open an issue in neo4j-apoc-procedures * Email us at security@neo4j.com
Credits
We want to publicly recognise the contribution of Christopher Schneider – State Farm.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.neo4j.procedure:apoc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.4.0.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.neo4j.procedure:apoc"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-24T17:39:18Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\nA XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin in Neo4j graph database. XML External Entity (XXE) injection occurs when the XML parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml procedure was not configured in a secure way and therefore allowed this.\n\nExternal entities can be used to read local files, send HTTP requests, and perform denial-of-service attacks on the application.\n\nAbusing the XXE vulnerability enabled assessors to read local files remotely. Although with the level of privileges assessors had this was limited to one-line files. With the ability to write to the database, any file could have been read. Additionally, assessors noted, with local testing, the server could be crashed by passing in improperly formatted XML. \n\n### Patches\nThe users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this vulnerability is 4.4.0.14. \n\n### Workarounds\nIf you cannot upgrade the library, you can control the\u00a0[allowlist](https://neo4j.com/docs/operations-manual/current/reference/configuration-settings/#config_dbms.security.procedures.allowlist) of the procedures\u00a0that can be used in your system.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in\u00a0[neo4j-apoc-procedures](https://github.com/neo4j-contrib/neo4j-apoc-procedures)\n* Email us at\u00a0[security@neo4j.com](mailto:security@neo4j.com)\n\n### Credits\nWe want to publicly recognise the contribution of Christopher Schneider \u2013 State Farm.\n",
"id": "GHSA-9vx8-f5c4-862x",
"modified": "2023-03-31T14:27:12Z",
"published": "2023-02-24T17:39:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-9vx8-f5c4-862x"
},
{
"type": "WEB",
"url": "https://github.com/neo4j/apoc/security/advisories/GHSA-6wxg-wh7f-rqpr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23926"
},
{
"type": "WEB",
"url": "https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/c3e2a29020497acf9417879f38e8af4e8c6d5783"
},
{
"type": "PACKAGE",
"url": "https://github.com/neo4j-contrib/neo4j-apoc-procedures"
},
{
"type": "WEB",
"url": "https://github.com/neo4j-contrib/neo4j-apoc-procedures/releases/tag/4.4.0.14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "XML External Entity (XXE) vulnerability in apoc.import.graphml"
}
GHSA-9W5Q-VV7J-283J
Vulnerability from github – Published: 2022-05-14 03:44 – Updated: 2022-05-14 03:44IBM Content Navigator 2.0 and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 137449.
{
"affected": [],
"aliases": [
"CVE-2018-1364"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-29T16:29:00Z",
"severity": "HIGH"
},
"details": "IBM Content Navigator 2.0 and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 137449.",
"id": "GHSA-9w5q-vv7j-283j",
"modified": "2022-05-14T03:44:35Z",
"published": "2022-05-14T03:44:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1364"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/137449"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg22012595"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102864"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-9X6M-HC4P-VJQ7
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE flaws. An attacker could use this flaw to cause DoS, SSRF, or information disclosure if they are able to provide XML content for parsing.
{
"affected": [],
"aliases": [
"CVE-2017-7464"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-27T12:29:00Z",
"severity": "CRITICAL"
},
"details": "It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE flaws. An attacker could use this flaw to cause DoS, SSRF, or information disclosure if they are able to provide XML content for parsing.",
"id": "GHSA-9x6m-hc4p-vjq7",
"modified": "2022-05-13T01:36:21Z",
"published": "2022-05-13T01:36:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7464"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7464"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98450"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9XP4-MQ53-C534
Vulnerability from github – Published: 2022-05-05 00:29 – Updated: 2024-04-03 23:57OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability
{
"affected": [],
"aliases": [
"CVE-2013-4333"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-01-24T15:15:00Z",
"severity": "CRITICAL"
},
"details": "OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability",
"id": "GHSA-9xp4-mq53-c534",
"modified": "2024-04-03T23:57:55Z",
"published": "2022-05-05T00:29:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4333"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/87031"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/09/11/6"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/62285"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C2H8-XFHJ-J9VH
Vulnerability from github – Published: 2022-05-24 16:59 – Updated: 2024-04-04 02:35Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
{
"affected": [],
"aliases": [
"CVE-2019-8087"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-25T16:15:00Z",
"severity": "HIGH"
},
"details": "Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.",
"id": "GHSA-c2h8-xfhj-j9vh",
"modified": "2024-04-04T02:35:08Z",
"published": "2022-05-24T16:59:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8087"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C2JJ-MCXW-PM5X
Vulnerability from github – Published: 2022-05-13 01:35 – Updated: 2022-05-13 01:35SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure and retrieval of arbitrary data, arbitrary code execution (in certain situations on specific platforms), and denial of service attacks.
{
"affected": [],
"aliases": [
"CVE-2018-10600"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-24T13:29:00Z",
"severity": "CRITICAL"
},
"details": "SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure and retrieval of arbitrary data, arbitrary code execution (in certain situations on specific platforms), and denial of service attacks.",
"id": "GHSA-c2jj-mcxw-pm5x",
"modified": "2022-05-13T01:35:00Z",
"published": "2022-05-13T01:35:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10600"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-191-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.