cve.bz

CWE-611: Improper Restriction of XML External Entity Reference, page 8

Filter

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

What the weakness is: CWE-611 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-221 Data Serialization External Entities Blowup

The attack patterns MITRE's CAPEC relates to CWE-611, as MITRE names them. Credits.

Ask an AI about CWE-611

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-611: Improper Restriction of XML External Entity Reference and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/611.html and https://cve.bz/cve/cwe/611?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2024-45490EPSS 1.7%

    An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

  2. 6.5CVE-2024-45048EPSS 0.6%

    PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XXE-attack. This in turn allows attacker to obtain contents of local files, even i…

  3. 8.8CVE-2024-22218EPSS 0.7%

    XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as acces…

  4. 7.5CVE-2024-38653ExploitEPSS 92%

    XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.

  5. 7.5CVE-2024-6893ExploitEPSS 33%

    The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server …

  6. 9.8CVE-2024-3930EPSS 0.3%

    In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered.

  7. 8.8CVE-2023-48362EPSS 0.8%

    XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes th…

  8. 4.3CVE-2024-40075EPSS 0.5%

    Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.

  9. 5.9CVE-2024-6961EPSS 0.4%

    RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal fil…

  10. 6.5CVE-2024-5625EPSS 0.4%

    Improper Restriction of XML External Entity Reference vulnerability in PruvaSoft Informatics Apinizer Management Console allows Data Serialization External Entities Blowup. This issue affects Apinizer Management Console: before 2024.05.1.

  11. 8.2CVE-2023-50304EPSS 0.6%

    IBM Engineering Requirements Management DOORS Web Access 9.7.2.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or…

  12. 7.5CVE-2024-38374EPSS 0.6%

    The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverage…

  13. 7.5CVE-2021-47621EPSS 0.6%

    ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.

  14. 7.2CVE-2023-49110EPSS 0.8%

    When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application (either on-premises or cloud/SaaS solution), the transmitted data consists of a ZIP archive containing several files, some of them in the XML fil…

  15. 9.8CVE-2024-34102KEVExploitEPSS >99.9%

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit…

  16. 9.1CVE-2024-37388EPSS 0.5%

    An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.

  17. 7.5CVE-2024-36827EPSS 0.5%

    An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.

  18. 8.2CVE-2023-45192EPSS 0.7%

    IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information …

  19. 9.8CVE-2024-3969EPSS 0.5%

    XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to remote code execution by parsing untrusted XML payload

  20. 6.5CVE-2024-4357EPSS 0.7%

    An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, allows low-privilege attacker to read systems file via XML External Entity Processing.

  21. 9.8CVE-2024-3486EPSS 0.5%

    XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to information disclosure and remote code execution.

  22. 7.5CVE-2024-30043EPSS 56%

    Microsoft SharePoint Server Information Disclosure Vulnerability

  23. 8.1CVE-2024-34345EPSS 0.9%

    The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in…

  24. 6.5CVE-2023-51605EPSS 0.8%

    Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Su…

  25. 6.5CVE-2023-51604EPSS 0.8%

    Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Su…

  26. 6.5CVE-2023-51602EPSS 0.8%

    Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Su…

  27. 6.5CVE-2023-51601EPSS 0.8%

    Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Su…

  28. 6.5CVE-2023-51600EPSS 0.8%

    Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Su…

  29. 7.5CVE-2023-51591EPSS 1.1%

    Voltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPow…

  30. 8.2CVE-2023-44412EPSS 82%

    D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of D-Link D-View. Authentication is not r…

  31. 6.5CVE-2023-42035EPSS 1.2%

    Visualware MyConnection Server doIForward XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Visualware MyConnectio…

  32. 7.5CVE-2023-40507EPSS 1.4%

    LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is…

  33. 7.5CVE-2023-40506EPSS 1.4%

    LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is…

  34. 7.5CVE-2023-40503EPSS 1.4%

    LG Simple Editor saveXmlFile XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is…

  35. 6.5CVE-2023-39472EPSS 1.3%

    Inductive Automation Ignition SimpleXMLReader XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Inductive Automati…

  36. 7.1CVE-2024-29010EPSS 0.6%

    The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the disclosure of sensitive information. This issue affects GMS: 9.3.4 and earlier versions.

  37. 7.0CVE-2024-22354EPSS 0.6%

    IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this…

  38. 9.8CVE-2024-21082EPSS 0.8%

    Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with netw…

  39. 4.3CVE-2024-21048EPSS 0.4%

    Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: XML input). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged att…

  40. 6.3CVE-2023-49234EPSS 0.2%

    An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server files and exfiltrate data to an external server.

  41. 6.5CVE-2024-25971EPSS 0.6%

    Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to information disclosure, denial-of-service.

  42. 8.1CVE-2024-31139EPSS 0.5%

    In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector

  43. 8.8CVE-2024-2826EPSS 0.6%

    A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The a…

  44. 5.8CVE-2024-28039EPSS 0.7%

    Improper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated attacker to obtain sensitive information, alter data, or cause a denial-of-service (DoS) condition.

  45. 8.2CVE-2024-27266EPSS 0.8%

    IBM Maximo Application Suite 7.6.1.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. …

  46. 7.7CVE-2023-50168EPSS 0.4%

    Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation.

  47. 7.5CVE-2024-28198EPSS 0.4%

    OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using the draw.io integration it is possible to read arbitrary files as the configur…

  48. 8.2CVE-2023-25926EPSS 1.4%

    IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive inf…

  49. 6.5CVE-2023-50380EPSS 0.9%

    XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oozie Workflow Scheduler had a vulnerability that allowed for root-level file read…

  50. 5.5CVE-2024-25129EPSS 0.8%

    The CodeQL CLI repo holds binaries for the CodeQL command line interface (CLI). Prior to version 2.16.3, an XML parser used by the CodeQL CLI to read various auxiliary files is vulnerable to an XML External Entity attack. If a vulnerable v…