CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1696 vulnerabilities reference this CWE, most recent first.
GHSA-CH7J-864F-M7R5
Vulnerability from github – Published: 2023-04-03 21:32 – Updated: 2023-04-10 18:30Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference.
{
"affected": [],
"aliases": [
"CVE-2022-43941"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-03T19:15:00Z",
"severity": "MODERATE"
},
"details": "Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference.",
"id": "GHSA-ch7j-864f-m7r5",
"modified": "2023-04-10T18:30:21Z",
"published": "2023-04-03T21:32:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43941"
},
{
"type": "WEB",
"url": "https://support.pentaho.com/hc/en-us/articles/14456719346957--Resolved-Pentaho-BA-Server-Improper-Restriction-of-XML-External-Entity-Reference-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-CVE-2022-43941-"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CHQF-HX79-GXC6
Vulnerability from github – Published: 2022-05-17 02:58 – Updated: 2024-10-07 21:29Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.4.1"
},
"package": {
"ecosystem": "PyPI",
"name": "openpyxl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-5992"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-01T11:49:57Z",
"nvd_published_at": "2017-02-15T19:59:00Z",
"severity": "MODERATE"
},
"details": "Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.",
"id": "GHSA-chqf-hx79-gxc6",
"modified": "2024-10-07T21:29:00Z",
"published": "2022-05-17T02:58:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5992"
},
{
"type": "WEB",
"url": "https://bitbucket.org/openpyxl/openpyxl/commits/3b4905f428e1"
},
{
"type": "WEB",
"url": "https://bitbucket.org/openpyxl/openpyxl/issues/749"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854442"
},
{
"type": "PACKAGE",
"url": "https://foss.heptapod.net/openpyxl/openpyxl"
},
{
"type": "WEB",
"url": "https://foss.heptapod.net/openpyxl/openpyxl/-/commit/7fe678fd89fd"
},
{
"type": "WEB",
"url": "https://foss.heptapod.net/openpyxl/openpyxl/-/issues/749"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-chqf-hx79-gxc6"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/openpyxl/PYSEC-2017-48.yaml"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/02/07/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H",
"type": "CVSS_V4"
}
],
"summary": "Improper Restriction of XML External Entity Reference in Openpyxl"
}
GHSA-CJ3W-G42V-WCJ6
Vulnerability from github – Published: 2025-04-10 12:26 – Updated: 2025-04-10 12:26Impact
This security advisory resolves a vulnerability in the RichText field type. By entering a maliciously crafted input into the RichText XML, an attacker could perform an attack using XML external entity (XXE) injection, which might be able to read files on the server. To exploit this vulnerability the attacker would need to already have edit permission to content with RichText fields, which typically means Editor role or higher. The fix removes unsafe elements from XML code, while preserving safe elements.
If you have a stored XXE attack in your content drafts, the fix prevents it from extracting data both during editing and preview. However, if such an attack has already been published and the result is stored in the content, it is unfortunately not possible to detect and remove it by automatic means.
Credits
This vulnerability was discovered and reported to Ibexa by Dennis Henke, Thorsten Niephaus, Marat Aytuganov, and Stephan Sekula of Compass Security Deutschland GmbH. We thank them for reporting it responsibly to us.
Patches
- See "Patched versions"
- https://github.com/ibexa/fieldtype-richtext/commit/823cba6b5ee2e81d7d74e622ce42c1451e8e1337
Workarounds
- Exploitation requires edit access to RichText content. If you can trust your editors, and you don't grant edit permission to any externals, you are not at risk in practice.
References
- https://developers.ibexa.co/security-advisories/ibexa-sa-2025-002-xxe-vulnerability-in-richtext
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ibexa/fieldtype-richtext"
},
"ranges": [
{
"events": [
{
"introduced": "4.6.0-beta1"
},
{
"fixed": "4.6.19"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-10T12:26:50Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nThis security advisory resolves a vulnerability in the RichText field type. By entering a maliciously crafted input into the RichText XML, an attacker could perform an attack using XML external entity (XXE) injection, which might be able to read files on the server. To exploit this vulnerability the attacker would need to already have edit permission to content with RichText fields, which typically means Editor role or higher. The fix removes unsafe elements from XML code, while preserving safe elements.\n\nIf you have a stored XXE attack in your content drafts, the fix prevents it from extracting data both during editing and preview. However, if such an attack has already been published and the result is stored in the content, it is unfortunately not possible to detect and remove it by automatic means.\n\n### Credits\nThis vulnerability was discovered and reported to Ibexa by Dennis Henke, Thorsten Niephaus, Marat Aytuganov, and Stephan Sekula of [Compass Security Deutschland GmbH](https://www.compass-security.com/en/). We thank them for reporting it responsibly to us.\n\n### Patches\n- See \"Patched versions\"\n- https://github.com/ibexa/fieldtype-richtext/commit/823cba6b5ee2e81d7d74e622ce42c1451e8e1337\n\n### Workarounds\n- Exploitation requires edit access to RichText content. If you can trust your editors, and you don\u0027t grant edit permission to any externals, you are not at risk in practice.\n\n### References\n- https://developers.ibexa.co/security-advisories/ibexa-sa-2025-002-xxe-vulnerability-in-richtext",
"id": "GHSA-cj3w-g42v-wcj6",
"modified": "2025-04-10T12:26:50Z",
"published": "2025-04-10T12:26:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ibexa/fieldtype-richtext/security/advisories/GHSA-cj3w-g42v-wcj6"
},
{
"type": "WEB",
"url": "https://github.com/ibexa/fieldtype-richtext/commit/823cba6b5ee2e81d7d74e622ce42c1451e8e1337"
},
{
"type": "WEB",
"url": "https://developers.ibexa.co/security-advisories/ibexa-sa-2025-002-xxe-vulnerability-in-richtext"
},
{
"type": "PACKAGE",
"url": "https://github.com/ibexa/fieldtype-richtext"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "ibexa/fieldtype-richtext allows access to external entities in XML"
}
GHSA-CJ73-6R9W-RXVQ
Vulnerability from github – Published: 2022-05-14 03:43 – Updated: 2022-05-14 03:43Multiple XML external entity (XXE) vulnerabilities in the AiCloud feature on ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U, DSL-N66U, and DSL-AC750 routers allow remote authenticated users to read arbitrary files via a crafted DTD in (1) an UPDATEACCOUNT or (2) a PROPFIND request.
{
"affected": [],
"aliases": [
"CVE-2017-14699"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-29T16:29:00Z",
"severity": "MODERATE"
},
"details": "Multiple XML external entity (XXE) vulnerabilities in the AiCloud feature on ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U, DSL-N66U, and DSL-AC750 routers allow remote authenticated users to read arbitrary files via a crafted DTD in (1) an UPDATEACCOUNT or (2) a PROPFIND request.",
"id": "GHSA-cj73-6r9w-rxvq",
"modified": "2022-05-14T03:43:39Z",
"published": "2022-05-14T03:43:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14699"
},
{
"type": "WEB",
"url": "https://www.asus.com/Networking/DSL-N14U-B1/HelpDesk_BIOS"
},
{
"type": "WEB",
"url": "https://www.securityartwork.es/2018/01/25/some-vulnerability-in-asus-routers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CJ78-RGW3-4H5P
Vulnerability from github – Published: 2022-03-11 00:02 – Updated: 2022-03-28 15:56An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.46"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"events": [
{
"introduced": "6.1.0"
},
{
"fixed": "6.2.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "proteus"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "proteus"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "proteus"
},
"ranges": [
{
"events": [
{
"introduced": "6.1.0"
},
{
"fixed": "6.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-26661"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-28T15:56:00Z",
"nvd_published_at": "2022-03-10T17:47:00Z",
"severity": "MODERATE"
},
"details": "An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.",
"id": "GHSA-cj78-rgw3-4h5p",
"modified": "2022-03-28T15:56:00Z",
"published": "2022-03-11T00:02:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26661"
},
{
"type": "WEB",
"url": "https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059"
},
{
"type": "WEB",
"url": "https://foss.heptapod.net/tryton/tryton/-/issues/11219"
},
{
"type": "PACKAGE",
"url": "https://hg.tryton.org/trytond"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5098"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5099"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference in trytond and proteus"
}
GHSA-CJ8X-Q3V5-MMVX
Vulnerability from github – Published: 2023-11-14 12:30 – Updated: 2023-11-14 12:30A vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions < V2.8). Affected products suffer from a XML external entity (XXE) injection vulnerability. This vulnerability could allow an attacker to interfere with an application's processing of XML data and read arbitrary files in the system.
{
"affected": [],
"aliases": [
"CVE-2023-46590"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-14T11:15:15Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions \u003c V2.8). Affected products suffer from a XML external entity (XXE) injection vulnerability. This vulnerability could allow an attacker to interfere with an application\u0027s processing of XML data and read arbitrary files in the system.",
"id": "GHSA-cj8x-q3v5-mmvx",
"modified": "2023-11-14T12:30:27Z",
"published": "2023-11-14T12:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46590"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-197270.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CJH7-GP4Q-5Q3R
Vulnerability from github – Published: 2025-05-06 18:30 – Updated: 2025-05-06 18:30Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering.
{
"affected": [],
"aliases": [
"CVE-2025-22478"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-06T16:15:27Z",
"severity": "HIGH"
},
"details": "Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering.",
"id": "GHSA-cjh7-gp4q-5q3r",
"modified": "2025-05-06T18:30:38Z",
"published": "2025-05-06T18:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22478"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000317318/dsa-2025-191-security-update-for-storage-center-dell-storage-manager-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CJJ2-FJV5-5QRQ
Vulnerability from github – Published: 2023-05-10 06:30 – Updated: 2024-04-04 03:58Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.
{
"affected": [],
"aliases": [
"CVE-2023-27527"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-10T06:15:13Z",
"severity": "HIGH"
},
"details": "Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.",
"id": "GHSA-cjj2-fjv5-5qrq",
"modified": "2024-04-04T03:58:37Z",
"published": "2023-05-10T06:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27527"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN73178249"
},
{
"type": "WEB",
"url": "https://www.touki-kyoutaku-online.moj.go.jp"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CM3H-688R-2C3X
Vulnerability from github – Published: 2022-05-13 01:04 – Updated: 2022-05-13 01:04Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.
{
"affected": [],
"aliases": [
"CVE-2018-7783"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-03T14:29:00Z",
"severity": "HIGH"
},
"details": "Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.",
"id": "GHSA-cm3h-688r-2c3x",
"modified": "2022-05-13T01:04:09Z",
"published": "2022-05-13T01:04:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7783"
},
{
"type": "WEB",
"url": "https://www.schneider-electric.com/en/download/document/SEVD-2018-142-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CMCG-F6R6-G4HH
Vulnerability from github – Published: 2024-05-15 18:30 – Updated: 2025-01-21 18:31XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to information disclosure and remote code execution.
{
"affected": [],
"aliases": [
"CVE-2024-3486"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-15T17:15:13Z",
"severity": "HIGH"
},
"details": "XML External Entity injection vulnerability found\u00a0in OpenText\u2122 iManager 3.2.6.0200. This could lead to information disclosure and remote code execution.\n\n",
"id": "GHSA-cmcg-f6r6-g4hh",
"modified": "2025-01-21T18:31:03Z",
"published": "2024-05-15T18:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3486"
},
{
"type": "WEB",
"url": "https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.