CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1801 vulnerabilities reference this CWE, most recent first.
GHSA-X832-FPVJ-R5PH
Vulnerability from github – Published: 2025-11-28 06:32 – Updated: 2025-12-01 20:46Mustang before 2.16.3 allows exfiltrating files via XXE attacks.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.mustangproject:library"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.16.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.mustangproject:validator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.16.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-66372"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-01T20:46:20Z",
"nvd_published_at": "2025-11-28T04:16:01Z",
"severity": "LOW"
},
"details": "Mustang before 2.16.3 allows exfiltrating files via XXE attacks.",
"id": "GHSA-x832-fpvj-r5ph",
"modified": "2025-12-01T20:46:20Z",
"published": "2025-11-28T06:32:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66372"
},
{
"type": "WEB",
"url": "https://github.com/ZUGFeRD/mustangproject/issues/685"
},
{
"type": "WEB",
"url": "https://github.com/ZUGFeRD/mustangproject/pull/725"
},
{
"type": "WEB",
"url": "https://github.com/ZUGFeRD/mustangproject/commit/6461dad8d3d7876547155dacbd28b458f1eb2e0b"
},
{
"type": "PACKAGE",
"url": "https://github.com/ZUGFeRD/mustangproject"
},
{
"type": "WEB",
"url": "https://github.com/ZUGFeRD/mustangproject/releases/tag/core-2.16.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Mustangproject allows exfiltrating files via XXE attacks"
}
GHSA-X879-CX33-WC6W
Vulnerability from github – Published: 2022-05-13 01:33 – Updated: 2022-05-13 01:33An XXE vulnerability exists in CASE Suite Versions 3.10 and prior when processing parameter entities, which may allow remote file disclosure.
{
"affected": [],
"aliases": [
"CVE-2018-17912"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-02T14:29:00Z",
"severity": "HIGH"
},
"details": "An XXE vulnerability exists in CASE Suite Versions 3.10 and prior when processing parameter entities, which may allow remote file disclosure.",
"id": "GHSA-x879-cx33-wc6w",
"modified": "2022-05-13T01:33:46Z",
"published": "2022-05-13T01:33:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17912"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-305-04"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/105804"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X996-H3MP-C4P4
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An attacker could use this flaw to cause remote code execution if they are able to provide XSLT content for parsing. Doing a transform in JAXP requires the use of a 'javax.xml.transform.TransformerFactory'. If the FEATURE_SECURE_PROCESSING feature is set to 'true', it mitigates this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2017-7465"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-27T16:29:00Z",
"severity": "CRITICAL"
},
"details": "It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An attacker could use this flaw to cause remote code execution if they are able to provide XSLT content for parsing. Doing a transform in JAXP requires the use of a \u0027javax.xml.transform.TransformerFactory\u0027. If the FEATURE_SECURE_PROCESSING feature is set to \u0027true\u0027, it mitigates this vulnerability.",
"id": "GHSA-x996-h3mp-c4p4",
"modified": "2022-05-13T01:36:21Z",
"published": "2022-05-13T01:36:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7465"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7465"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97605"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X99J-H38H-9FRX
Vulnerability from github – Published: 2022-05-13 01:17 – Updated: 2022-05-13 01:17A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerability is due to improper handling of XML External Entities (XXEs) when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file. Cisco Bug IDs: CSCve70595.
{
"affected": [],
"aliases": [
"CVE-2018-0207"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-08T07:29:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerability is due to improper handling of XML External Entities (XXEs) when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file. Cisco Bug IDs: CSCve70595.",
"id": "GHSA-x99j-h38h-9frx",
"modified": "2022-05-13T01:17:29Z",
"published": "2022-05-13T01:17:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0207"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103343"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040470"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X9V6-5M2F-Q2HR
Vulnerability from github – Published: 2022-05-24 17:46 – Updated: 2022-05-24 17:46The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is vulnerable to XML external entity (XXE) injection in the Web Console. The vulnerability requires admin user privileges and knowledge of the XML file's encryption key to successfully exploit. All versions before 7.11 are affected.
{
"affected": [],
"aliases": [
"CVE-2021-22158"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-06T21:15:00Z",
"severity": "HIGH"
},
"details": "The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is vulnerable to XML external entity (XXE) injection in the Web Console. The vulnerability requires admin user privileges and knowledge of the XML file\u0027s encryption key to successfully exploit. All versions before 7.11 are affected.",
"id": "GHSA-x9v6-5m2f-q2hr",
"modified": "2022-05-24T17:46:36Z",
"published": "2022-05-24T17:46:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22158"
},
{
"type": "WEB",
"url": "https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0003"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XC2C-W3G3-GC65
Vulnerability from github – Published: 2022-05-14 03:49 – Updated: 2022-05-14 03:49Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality resulting in denial of service and possibly remote execution of code.
{
"affected": [],
"aliases": [
"CVE-2017-1000496"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-03T14:29:00Z",
"severity": "HIGH"
},
"details": "Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality resulting in denial of service and possibly remote execution of code.",
"id": "GHSA-xc2c-w3g3-gc65",
"modified": "2022-05-14T03:49:57Z",
"published": "2022-05-14T03:49:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000496"
},
{
"type": "WEB",
"url": "https://github.com/commsy/commsy/issues/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XC72-7FJV-V78H
Vulnerability from github – Published: 2022-05-14 01:15 – Updated: 2022-05-14 01:15Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7.
{
"affected": [],
"aliases": [
"CVE-2019-3481"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-25T17:29:00Z",
"severity": "HIGH"
},
"details": "Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7.",
"id": "GHSA-xc72-7fjv-v78h",
"modified": "2022-05-14T01:15:49Z",
"published": "2022-05-14T01:15:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3481"
},
{
"type": "WEB",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03355866"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XF3G-MQGG-66G3
Vulnerability from github – Published: 2022-05-14 01:30 – Updated: 2022-05-14 01:30An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and potentially cause a Denial of Service.
{
"affected": [],
"aliases": [
"CVE-2018-9116"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-29T07:29:00Z",
"severity": "CRITICAL"
},
"details": "An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and potentially cause a Denial of Service.",
"id": "GHSA-xf3g-mqgg-66g3",
"modified": "2022-05-14T01:30:32Z",
"published": "2022-05-14T01:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9116"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!topic/wiremock-user/PQ1UQzKZVl0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XF3V-QXXV-424V
Vulnerability from github – Published: 2022-05-14 03:54 – Updated: 2022-05-14 03:54IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125150.
{
"affected": [],
"aliases": [
"CVE-2017-1289"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-22T20:29:00Z",
"severity": "HIGH"
},
"details": "IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125150.",
"id": "GHSA-xf3v-qxxv-424v",
"modified": "2022-05-14T03:54:57Z",
"published": "2022-05-14T03:54:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1289"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1220"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1221"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1222"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:3453"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/docview.wss?uid=swg22002169"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98401"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XFCJ-2F35-8GFW
Vulnerability from github – Published: 2023-06-26 21:31 – Updated: 2024-04-04 05:10An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files.
{
"affected": [],
"aliases": [
"CVE-2023-3113"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-26T20:15:10Z",
"severity": "HIGH"
},
"details": "An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA\u0027s Common Information Model (CIM) server that could result in read-only access to specific files.",
"id": "GHSA-xfcj-2f35-8gfw",
"modified": "2024-04-04T05:10:55Z",
"published": "2023-06-26T21:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3113"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/us/en/product_security/LEN-98715"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.