CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1748 vulnerabilities reference this CWE, most recent first.
GHSA-3HRC-F439-727G
Vulnerability from github – Published: 2018-10-16 23:08 – Updated: 2022-11-17 18:38XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.camel:camel-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.13.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.camel:camel-core"
},
"ranges": [
{
"events": [
{
"introduced": "2.14.0"
},
{
"fixed": "2.14.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-0263"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T20:55:17Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.",
"id": "GHSA-3hrc-f439-727g",
"modified": "2022-11-17T18:38:58Z",
"published": "2018-10-16T23:08:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0263"
},
{
"type": "WEB",
"url": "https://github.com/apache/camel/commit/06db9e0744f2bb9f6e3bf16c0dfe7099a3481558"
},
{
"type": "WEB",
"url": "https://github.com/apache/camel/commit/367d53e73c8b5a1e73c24423e631709f9a96e08d"
},
{
"type": "WEB",
"url": "https://github.com/apache/camel/commit/7d19340bcdb42f7aae584d9c5003ac4f7ddaee36"
},
{
"type": "WEB",
"url": "https://camel.apache.org/security-advisories.data/CVE-2015-0263.txt.asc"
},
{
"type": "WEB",
"url": "https://git-wip-us.apache.org/repos/asf?p=camel.git;a=commitdiff;h=7d19340bcdb42f7aae584d9c5003ac4f7ddaee36"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-3hrc-f439-727g"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/camel"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/CAMEL-8312"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1041.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1538.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1539.html"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1032442"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Apache Camel XML External Entity vulnerability"
}
GHSA-3J9C-CP7M-8W8G
Vulnerability from github – Published: 2022-05-13 01:30 – Updated: 2025-03-13 17:48XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted job configuration that is then used in an "XML-aware tool," as demonstrated by get-job and update-job.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"events": [
{
"introduced": "1.626"
},
{
"fixed": "1.638"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.625.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-5319"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T17:48:30Z",
"nvd_published_at": "2015-11-25T20:59:00Z",
"severity": "MODERATE"
},
"details": "XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted job configuration that is then used in an \"XML-aware tool,\" as demonstrated by get-job and update-job.",
"id": "GHSA-3j9c-cp7m-8w8g",
"modified": "2025-03-13T17:48:30Z",
"published": "2022-05-13T01:30:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5319"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jenkins/commit/e78e9e8144f7304cf274cd4b756f458cf63a3556"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Jenkins has XML External Entity (XXE) Vulnerability in Job Configuration via CLI"
}
GHSA-3JH7-WM29-Q568
Vulnerability from github – Published: 2026-07-29 15:11 – Updated: 2026-07-29 15:11Summary
Description An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text (/RC or /RV) entry. This affects all current versions of veraPDF-validation.
Details
The vulnerability resides in veraPDF-validation validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java within the getRichTextStringOrStreamEntryStringRepresentation() method. This helper extracts the XHTML rich-text body from a PDF dictionary string or stream and parses it with a DOM parser to return the concatenated text content.
The vulnerability stems from two combined issues:
- The DocumentBuilderFactory is instantiated with default settings , no disallow-doctype-decl, no disabling of external general/parameter entities, no FEATURE_SECURE_PROCESSING, and no secure EntityResolver. The default JAXP/Xerces parser will therefore resolve <!DOCTYPE … SYSTEM "…"> and <!ENTITY … SYSTEM "…"> declarations.
- After parsing, getAllNodeText() recursively concatenates every text node in the document and returns it as the model property value. This means the expanded contents of any external entity are reflected directly back into the validation report.
Impact
This impacts all current releases of the veraPDF validation-model module.
Successful exploitation requires only that the target validate an attacker-supplied PDF. A single markup annotation with a crafted /RC string is sufficient.
Proposed Patch
Harden the DocumentBuilderFactory in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java per the OWASP XXE Prevention Cheat Sheet to disallow DOCTYPE outright.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.30.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:validation-model"
},
"ranges": [
{
"events": [
{
"introduced": "1.25.73"
},
{
"fixed": "1.30.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.31.70"
},
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:validation-model"
},
"ranges": [
{
"events": [
{
"introduced": "1.31.1"
},
{
"fixed": "1.31.71"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.30.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:validation-model-jakarta"
},
"ranges": [
{
"events": [
{
"introduced": "1.25.73"
},
{
"fixed": "1.30.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.31.70"
},
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:validation-model-jakarta"
},
"ranges": [
{
"events": [
{
"introduced": "1.31.1"
},
{
"fixed": "1.31.71"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54078"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-29T15:11:43Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary \n \n**Description**\nAn XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text (/RC or /RV) entry. This affects all current versions of veraPDF-validation. \n \n## Details \nThe vulnerability resides in veraPDF-validation `validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java` within the `getRichTextStringOrStreamEntryStringRepresentation()` method. This helper extracts the XHTML rich-text body from a PDF dictionary string or stream and parses it with a DOM parser to return the concatenated text content. \n \nThe vulnerability stems from two combined issues: \n- The DocumentBuilderFactory is instantiated with default settings , no disallow-doctype-decl, no disabling of external general/parameter entities, no FEATURE_SECURE_PROCESSING, and no secure EntityResolver. The default JAXP/Xerces parser will therefore resolve `\u003c!DOCTYPE \u2026 SYSTEM \"\u2026\"\u003e` and `\u003c!ENTITY \u2026 SYSTEM \"\u2026\"\u003e` declarations. \n- After parsing, `getAllNodeText()` recursively concatenates every text node in the document and returns it as the model property value. This means the expanded contents of any external entity are reflected directly back into the validation report. \n \n## Impact \n \nThis impacts all current releases of the veraPDF validation-model module. \n \nSuccessful exploitation requires only that the target validate an attacker-supplied PDF. A single markup annotation with a crafted /RC string is sufficient. \n \n## Proposed Patch \n \nHarden the `DocumentBuilderFactory` in `validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java` per the OWASP XXE Prevention Cheat Sheet to disallow DOCTYPE outright.",
"id": "GHSA-3jh7-wm29-q568",
"modified": "2026-07-29T15:11:43Z",
"published": "2026-07-29T15:11:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-3jh7-wm29-q568"
},
{
"type": "PACKAGE",
"url": "https://github.com/veraPDF/veraPDF-validation"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "veraPDF Validation XXE via Rich Text"
}
GHSA-3JW3-99X8-H6XC
Vulnerability from github – Published: 2022-05-24 17:48 – Updated: 2022-05-24 17:48FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely.
{
"affected": [],
"aliases": [
"CVE-2021-27736"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-22T14:15:00Z",
"severity": "MODERATE"
},
"details": "FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely.",
"id": "GHSA-3jw3-99x8-h6xc",
"modified": "2022-05-24T17:48:09Z",
"published": "2022-05-24T17:48:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27736"
},
{
"type": "WEB",
"url": "https://github.com/FusionAuth/fusionauth-samlv2/commit/c66fb689d50010662f705d5b585c6388ce555dbd"
},
{
"type": "WEB",
"url": "https://github.com/FusionAuth/fusionauth-samlv2/compare/0.5.3...0.5.4"
},
{
"type": "WEB",
"url": "https://www.compass-security.com/fileadmin/Research/Advisories/2021-03_CSNC-2021-004_FusionAuth_SAML_Library_XML_External_Entity.txt"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3M9X-2QFJ-XVQ4
Vulnerability from github – Published: 2024-11-07 17:28 – Updated: 2024-11-07 17:28PHPExcel XXE Vulnerability
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpoffice/phpexcel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-3542"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-11-07T17:28:59Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "PHPExcel XXE Vulnerability",
"id": "GHSA-3m9x-2qfj-xvq4",
"modified": "2024-11-07T17:28:59Z",
"published": "2024-11-07T17:28:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/PHPOffice/PHPExcel/commit/0ab614fd952f82f9b7a9280731daa2300e6b000c"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpexcel/CVE-2015-3542.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/PHPOffice/PHPExcel"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "PHPExcel XXE Vulnerability"
}
GHSA-3MJP-86XG-FF9V
Vulnerability from github – Published: 2022-08-31 00:00 – Updated: 2022-09-08 00:00Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 and 11.6.600 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn't usually have access to via a carefully constructed XML file, which the DLP Agent doesn't parse correctly.
{
"affected": [],
"aliases": [
"CVE-2022-2330"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-30T08:15:00Z",
"severity": "MODERATE"
},
"details": "Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 and 11.6.600 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn\u0027t usually have access to via a carefully constructed XML file, which the DLP Agent doesn\u0027t parse correctly.",
"id": "GHSA-3mjp-86xg-ff9v",
"modified": "2022-09-08T00:00:39Z",
"published": "2022-08-31T00:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2330"
},
{
"type": "WEB",
"url": "https://kcm.trellix.com/corporate/index?page=content\u0026id=SB10386"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3MJQ-GR7R-H6X3
Vulnerability from github – Published: 2024-11-18 21:30 – Updated: 2025-10-20 18:30An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file.
{
"affected": [],
"aliases": [
"CVE-2024-50848"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-18T21:15:06Z",
"severity": "MODERATE"
},
"details": "An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file.",
"id": "GHSA-3mjq-gr7r-h6x3",
"modified": "2025-10-20T18:30:29Z",
"published": "2024-11-18T21:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50848"
},
{
"type": "WEB",
"url": "https://github.com/1mhr4b/CVE-2024-50848"
},
{
"type": "WEB",
"url": "https://github.com/Wh1teSnak3/CVE-2024-50848"
},
{
"type": "WEB",
"url": "https://www.trados.com/product/worldserver"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3MMX-QQMQ-RM69
Vulnerability from github – Published: 2022-05-24 17:40 – Updated: 2022-05-24 17:40IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 192025.
{
"affected": [],
"aliases": [
"CVE-2020-4949"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-26T15:15:00Z",
"severity": "HIGH"
},
"details": "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 192025.",
"id": "GHSA-3mmx-qqmq-rm69",
"modified": "2022-05-24T17:40:18Z",
"published": "2022-05-24T17:40:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4949"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/192025"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6408244"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3MWF-3W9J-82VF
Vulnerability from github – Published: 2026-06-09 21:32 – Updated: 2026-06-09 21:32ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
{
"affected": [],
"aliases": [
"CVE-2026-47960"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-09T21:17:24Z",
"severity": "HIGH"
},
"details": "ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML External Entity Reference (\u0027XXE\u0027) vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.",
"id": "GHSA-3mwf-3w9j-82vf",
"modified": "2026-06-09T21:32:39Z",
"published": "2026-06-09T21:32:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47960"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-64.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3PPH-2595-CGFH
Vulnerability from github – Published: 2018-10-17 19:55 – Updated: 2024-03-04 20:32This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the &dataConfig=<inlinexml> parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.solr:solr-core"
},
"ranges": [
{
"events": [
{
"introduced": "1.2"
},
{
"fixed": "6.6.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.solr:solr-core"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1308"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T20:55:43Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `\u0026dataConfig=\u003cinlinexml\u003e` parameter of Solr\u0027s DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.",
"id": "GHSA-3pph-2595-cgfh",
"modified": "2024-03-04T20:32:45Z",
"published": "2018-10-17T19:55:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1308"
},
{
"type": "WEB",
"url": "https://github.com/apache/lucene-solr/commit/3530397f1777332872eac2760f9aa0e2ae1d7450"
},
{
"type": "WEB",
"url": "https://github.com/apache/lucene-solr/commit/739a7933"
},
{
"type": "WEB",
"url": "https://github.com/apache/lucene-solr/commit/dd3be31f7062dcb2f3b2d7f0e89df29e197dee63"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-3pph-2595-cgfh"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/SOLR-11971"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00025.html"
},
{
"type": "WEB",
"url": "https://mail-archives.apache.org/mod_mbox/www-announce/201804.mbox/%3C000001d3cf68%245ac69af0%241053d0d0%24%40apache.org%3E"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4194"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "There is a XML external entity expansion (XXE) vulnerability in Apache Solr "
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.