cve.bz

CWE-611: Improper Restriction of XML External Entity Reference, page 14

Filter

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

What the weakness is: CWE-611 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-221 Data Serialization External Entities Blowup

The attack patterns MITRE's CAPEC relates to CWE-611, as MITRE names them. Credits.

Ask an AI about CWE-611

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-611: Improper Restriction of XML External Entity Reference and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/611.html and https://cve.bz/cve/cwe/611?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2021-44477EPSS 1.1%

    GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of…

  2. 9.8CVE-2021-43090EPSS 1.9%

    An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function.

  3. 3.8CVE-2022-0861EPSS 0.5%

    A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is lim…

  4. 7.2CVE-2021-42194EPSS 1.1%

    The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, which itself does not prohibit external entities, triggering a XML external entity (…

  5. 5.5CVE-2022-27193EPSS 0.7%

    CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the syst…

  6. 6.5CVE-2022-26661EPSS 1.4%

    An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through …

  7. 6.5CVE-2022-22835EPSS 14%

    An issue was discovered in OverIT Geocall before version 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XXE vulnerability to read arbitrary files from the filesystem.

  8. 9.1CVE-2022-22795EPSS 1.1%

    Signiant - Manager+Agents XML External Entity (XXE) - Extract internal files of the affected machine An attacker can read all the system files, the product is running with root on Linux systems and nt/authority on windows systems, which al…

  9. 9.1CVE-2022-25312EPSS 2.9%

    An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability t…

  10. 9.8CVE-2022-0839EPSS 3.0%

    Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.

  11. 9.8CVE-2022-0265EPSS 2.8%

    Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.

  12. 9.8CVE-2022-23640EPSS 1.3%

    Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. U…

  13. 9.8CVE-2022-24340EPSS 1.0%

    In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible.

  14. 7.1CVE-2020-14478EPSS 0.3%

    A local, authenticated attacker could use an XML External Entity (XXE) attack to exploit weakly configured XML files to access local or remote content. A successful exploit could potentially cause a denial-of-service condition and allow th…

  15. 8.8CVE-2022-25209EPSS 1.1%

    Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  16. 7.8CVE-2021-46365EPSS 1.7%

    An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file.

  17. 7.8CVE-2022-21220EPSS 0.2%

    Improper restriction of XML external entity for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privilege via local access.

  18. 7.5CVE-2022-21205EPSS 1.1%

    Improper restriction of XML external entity reference in DSP Builder Pro for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an unauthenticated user to potentially enable information disclosure via network access.

  19. 9.8CVE-2021-46660EPSS 1.2%

    Signiant Manager+Agents before 15.1 allows XML External Entity (XXE) attacks.

  20. 4.9CVE-2022-23031EPSS 0.8%

    On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE) vulnerability exists in an undisclosed page of the F5 Advanced Web Application Firewall (Adv…

  21. 8.2CVE-2020-4876EPSS 1.7%

    IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory …

  22. 8.2CVE-2020-4875EPSS 1.7%

    IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory …

  23. 5.5CVE-2022-0219EPSS 1.1%

    Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.

  24. 5.3CVE-2022-21282EPSS 2.9%

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: …

  25. 9.8CVE-2022-0239EPSS 1.2%

    corenlp is vulnerable to Improper Restriction of XML External Entity Reference

  26. 9.8CVE-2021-40722EPSS 3.3%

    AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.

  27. 7.1CVE-2022-0198EPSS 0.7%

    corenlp is vulnerable to Improper Restriction of XML External Entity Reference

  28. 8.8CVE-2021-42560EPSS 2.1%

    An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These SVG documents are parsed in an unsafe manner and can be leveraged for XXE attacks (e.g., File Exfil…

  29. 5.5CVE-2021-44028EPSS 3.1%

    XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a related issue to CVE-2018-1285.

  30. 4.3CVE-2021-45096EPSS 1.1%

    KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730.

  31. 5.5CVE-2021-3836EPSS 0.9%

    dbeaver is vulnerable to Improper Restriction of XML External Entity Reference

  32. 9.1CVE-2021-23463EPSS 2.8%

    The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML()…

  33. 9.1CVE-2021-44557EPSS 1.3%

    National Library of the Netherlands multiNER <= c0440948057afc6e3d6b4903a7c05e666b94a3bc is affected by an XML External Entity (XXE) vulnerability in multiNER/ner.py. Since XML parsing resolves external entities, a malicious XML stream cou…

  34. 9.1CVE-2021-44556EPSS 1.3%

    National Library of the Netherlands digger < 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity (XXE) vulnerability. Since XML parsing resolves external entities, a malicious XML stream could leak internal files …

  35. 7.7CVE-2021-42776EPSS 0.8%

    CloverDX Server before 5.11.2 and and 5.12.x before 5.12.1 allows XXE during configuration import.

  36. 5.5CVE-2021-44147EPSS 1.2%

    An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose local files via a crafted XML/Excel document and perform server-side request forgery attacks.

  37. 7.1CVE-2021-43577EPSS 1.0%

    Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  38. 6.5CVE-2021-43576EPSS 2.4%

    Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses ext…

  39. 6.5CVE-2021-21701EPSS 1.7%

    Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  40. 8.1CVE-2021-36172EPSS 0.8%

    An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consumed by FortiPortal to trigger a denial of…

  41. 6.5CVE-2021-20839EPSS 1.1%

    Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition to the other servers by proce…

  42. 7.5CVE-2021-20838EPSS 1.5%

    Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition by processing a specially cra…

  43. 9.1CVE-2020-26705EPSS 1.3%

    The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows for an attacker to expose sensitive data or perform a denial of service (DOS) via a crafted external entity entered into …

  44. 9.1CVE-2020-25912EPSS 1.4%

    A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to an information disclosure or denial of service (DOS).

  45. 9.1CVE-2020-25911EPSS 2.4%

    A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

  46. 7.5CVE-2021-3869EPSS 1.4%

    corenlp is vulnerable to Improper Restriction of XML External Entity Reference

  47. 9.8CVE-2021-3878EPSS 1.9%

    corenlp is vulnerable to Improper Restriction of XML External Entity Reference

  48. 7.5CVE-2020-19954EPSS 1.2%

    An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files.

  49. 6.5CVE-2021-20801EPSS 1.1%

    Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to conduct XML External Entity (XXE) attacks and obtain the information stored in the product via unspecified vectors. This issue occurs only when using Mozilla Fi…

  50. 7.5CVE-2021-35496EPSS 0.6%

    The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Ser…