CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1696 vulnerabilities reference this CWE, most recent first.
GHSA-CCMR-QJ26-845G
Vulnerability from github – Published: 2022-05-13 01:34 – Updated: 2022-06-28 23:22Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.elasticsearch:elasticsearch"
},
"ranges": [
{
"events": [
{
"introduced": "6.5.0"
},
{
"fixed": "6.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-17247"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-28T23:22:46Z",
"nvd_published_at": "2018-12-20T22:29:00Z",
"severity": "MODERATE"
},
"details": "Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning\u0027s find_file_structure API. If a policy allowing external network access has been added to Elasticsearch\u0027s Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.",
"id": "GHSA-ccmr-qj26-845g",
"modified": "2022-06-28T23:22:46Z",
"published": "2022-05-13T01:34:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17247"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/elastic-stack-6-5-2-security-update/159594"
},
{
"type": "WEB",
"url": "https://www.elastic.co/community/security"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106294"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference in Elasticsearch"
}
GHSA-CCPX-2WJ9-VW2W
Vulnerability from github – Published: 2022-05-17 19:57 – Updated: 2024-04-04 00:00XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document.
{
"affected": [],
"aliases": [
"CVE-2014-5238"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-01-14T16:15:00Z",
"severity": "HIGH"
},
"details": "XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document.",
"id": "GHSA-ccpx-2wj9-vw2w",
"modified": "2024-04-04T00:00:18Z",
"published": "2022-05-17T19:57:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5238"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html"
},
{
"type": "WEB",
"url": "http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdf"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/archive/1/533443/100/0/threaded"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CCRC-9X59-3VC4
Vulnerability from github – Published: 2023-06-29 21:30 – Updated: 2023-07-06 21:39requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "requests-xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-26708"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-30T20:36:25Z",
"nvd_published_at": "2023-06-29T21:15:09Z",
"severity": "HIGH"
},
"details": "requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.",
"id": "GHSA-ccrc-9x59-3vc4",
"modified": "2023-07-06T21:39:44Z",
"published": "2023-06-29T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26708"
},
{
"type": "WEB",
"url": "https://github.com/erinxocon/requests-xml/issues/7"
},
{
"type": "PACKAGE",
"url": "https://github.com/erinxocon/requests-xml"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/requests-xml/PYSEC-2023-96.yaml"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230908-0003"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "requests-xml XML External Entity Injection vulnerability"
}
GHSA-CF9W-6PRV-PR7R
Vulnerability from github – Published: 2022-11-12 12:00 – Updated: 2025-05-01 15:31CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure.
{
"affected": [],
"aliases": [
"CVE-2022-45194"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-12T00:15:00Z",
"severity": "MODERATE"
},
"details": "CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure.",
"id": "GHSA-cf9w-6prv-pr7r",
"modified": "2025-05-01T15:31:31Z",
"published": "2022-11-12T12:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45194"
},
{
"type": "WEB",
"url": "https://zigrin.com/advisories/cbrn-analysis-external-xml-entity-injection"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CFHW-X225-JRHR
Vulnerability from github – Published: 2022-05-24 17:44 – Updated: 2022-05-24 17:44A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). When opening a specially crafted SEECTCXML file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external dtd. (ZDI-CAN-11923)
{
"affected": [],
"aliases": [
"CVE-2020-28387"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-15T17:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in Solid Edge SE2020 (All Versions \u003c SE2020MP13), Solid Edge SE2021 (All Versions \u003c SE2021MP3). When opening a specially crafted SEECTCXML file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external dtd. (ZDI-CAN-11923)",
"id": "GHSA-cfhw-x225-jrhr",
"modified": "2022-05-24T17:44:32Z",
"published": "2022-05-24T17:44:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28387"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-715184.pdf"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CFM2-F46F-RC3G
Vulnerability from github – Published: 2026-02-27 09:30 – Updated: 2026-02-27 09:30An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references.
This issue affects Xerox FreeFlow Core versions up to and including 8.0.7.
Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads
{
"affected": [],
"aliases": [
"CVE-2026-2252"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-27T09:16:17Z",
"severity": "HIGH"
},
"details": "An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references.\n\nThis issue affects Xerox FreeFlow Core versions up to and including 8.0.7.\u00a0\n\nPlease consider upgrading to FreeFlow Core version 8.1.0 via the software available on -\u00a0 https://www.support.xerox.com/en-us/product/core/downloads",
"id": "GHSA-cfm2-f46f-rc3g",
"modified": "2026-02-27T09:30:29Z",
"published": "2026-02-27T09:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2252"
},
{
"type": "WEB",
"url": "https://securitydocs.business.xerox.com/wp-content/uploads/2026/02/Xerox-Security-Bulletin-026-005-for-Xerox-Freeflow-Core.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CFXJ-95GX-6RXG
Vulnerability from github – Published: 2022-05-24 17:38 – Updated: 2022-05-24 17:38A vulnerability has been identified in JT2Go (All Versions < V13.1.0), Teamcenter Visualization (All Versions < V13.1.0). When opening a specially crafted xml file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external dtd.
{
"affected": [],
"aliases": [
"CVE-2020-26981"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-12T21:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in JT2Go (All Versions \u003c V13.1.0), Teamcenter Visualization (All Versions \u003c V13.1.0). When opening a specially crafted xml file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external dtd.",
"id": "GHSA-cfxj-95gx-6rxg",
"modified": "2022-05-24T17:38:32Z",
"published": "2022-05-24T17:38:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26981"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-622830.pdf"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-048"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CGH7-RGQG-HRCX
Vulnerability from github – Published: 2023-09-06 15:30 – Updated: 2024-01-30 23:11Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1227.v7a"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:jobConfigHistory"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1229.v3039470161a_d"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-41932"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T23:11:19Z",
"nvd_published_at": "2023-09-06T13:15:09Z",
"severity": "MODERATE"
},
"details": "Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict \u0027timestamp\u0027 query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called \u0027history.xml\u0027.",
"id": "GHSA-cgh7-rgqg-hrcx",
"modified": "2024-01-30T23:11:19Z",
"published": "2023-09-06T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41932"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3235"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/09/06/9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Path traversal allows exploiting XXE vulnerability in Jenkins Job Configuration History Plugin"
}
GHSA-CGV8-9R56-PQQH
Vulnerability from github – Published: 2022-04-06 00:01 – Updated: 2022-04-13 00:00Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.
{
"affected": [],
"aliases": [
"CVE-2022-28219"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-05T19:15:00Z",
"severity": "CRITICAL"
},
"details": "Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.",
"id": "GHSA-cgv8-9r56-pqqh",
"modified": "2022-04-13T00:00:42Z",
"published": "2022-04-06T00:01:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28219"
},
{
"type": "WEB",
"url": "https://manageengine.com"
},
{
"type": "WEB",
"url": "https://www.horizon3.ai/red-team-blog-cve-2022-28219"
},
{
"type": "WEB",
"url": "https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html"
},
{
"type": "WEB",
"url": "http://cewolf.sourceforge.net/new/index.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/167997/ManageEngine-ADAudit-Plus-Path-Traversal-XML-Injection.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CH3R-FWQ3-PP8F
Vulnerability from github – Published: 2022-05-24 16:59 – Updated: 2024-04-04 02:35Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
{
"affected": [],
"aliases": [
"CVE-2019-8086"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-25T16:15:00Z",
"severity": "HIGH"
},
"details": "Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.",
"id": "GHSA-ch3r-fwq3-pp8f",
"modified": "2024-04-04T02:35:04Z",
"published": "2022-05-24T16:59:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8086"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.