CWE-611
Improper Restriction of XML External Entity Reference
Description
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Hierarchy (View 1000)
Parents
Children
none
Related attack patterns (CAPEC)
CAPEC-221
CVEs mapped to this weakness (1,331)
page 14 of 67| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-30971 | Hig | 0.57 | 8.8 | 0.01 | May 17, 2022 | Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | ||
| CVE-2022-21949 | Hig | 0.57 | 8.8 | 0.02 | May 3, 2022 | A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges… | ||
| CVE-2022-0272 | Cri | 0.57 | 9.8 | 0.01 | Apr 21, 2022 | Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0. | ||
| CVE-2021-43090 | Cri | 0.57 | 9.8 | 0.02 | Mar 25, 2022 | An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function. | ||
| CVE-2022-0839 | Cri | 0.57 | 9.8 | 0.03 | Mar 4, 2022 | Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0. | ||
| CVE-2022-0265 | Cri | 0.57 | 9.8 | 0.03 | Mar 3, 2022 | Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1. | ||
| CVE-2022-23640 | Cri | 0.57 | 9.8 | 0.01 | Mar 2, 2022 | Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a… | ||
| CVE-2022-25209 | Hig | 0.57 | 8.8 | 0.01 | Feb 15, 2022 | Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | ||
| CVE-2022-0239 | Cri | 0.57 | 9.8 | 0.01 | Jan 17, 2022 | corenlp is vulnerable to Improper Restriction of XML External Entity Reference | ||
| CVE-2021-42560 | Hig | 0.57 | 8.8 | 0.02 | Jan 12, 2022 | An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These SVG documents are parsed in an unsafe manner and can be leveraged for XXE attacks (e.g., File Exfiltration, Server Side Request Forgery,… | ||
| CVE-2021-3878 | Cri | 0.57 | 9.8 | 0.02 | Oct 15, 2021 | corenlp is vulnerable to Improper Restriction of XML External Entity Reference | ||
| CVE-2021-21657 | Hig | 0.57 | 8.8 | 0.02 | May 25, 2021 | Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | ||
| CVE-2021-23899 | Cri | 0.57 | 9.8 | 0.02 | Jan 13, 2021 | OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents. | ||
| CVE-2020-28736 | Hig | 0.57 | 8.8 | 0.01 | Dec 30, 2020 | Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role). | ||
| CVE-2020-28734 | Hig | 0.57 | 8.8 | 0.01 | Dec 30, 2020 | Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role. | ||
| CVE-2020-29128 | Cri | 0.57 | 9.8 | 0.02 | Nov 26, 2020 | petl before 1.68, in some configurations, allows resolution of entities in an XML document. | ||
| CVE-2020-7572 | Hig | 0.57 | 8.8 | 0.02 | Nov 19, 2020 | A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial… | ||
| CVE-2020-10683 | Cri | 0.57 | 9.8 | 0.07 | May 1, 2020 | dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j. | ||
| CVE-2020-2171 | Hig | 0.57 | 8.8 | 0.01 | Mar 25, 2020 | Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | ||
| CVE-2019-20627 | Cri | 0.57 | 9.8 | 0.02 | Mar 23, 2020 | AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE. |
- risk 0.57cvss 8.8epss 0.01
Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- risk 0.57cvss 8.8epss 0.02
A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges…
- risk 0.57cvss 9.8epss 0.01
Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
- risk 0.57cvss 9.8epss 0.02
An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function.
- risk 0.57cvss 9.8epss 0.03
Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.
- risk 0.57cvss 9.8epss 0.03
Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.
- risk 0.57cvss 9.8epss 0.01
Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a…
- risk 0.57cvss 8.8epss 0.01
Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- risk 0.57cvss 9.8epss 0.01
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
- risk 0.57cvss 8.8epss 0.02
An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These SVG documents are parsed in an unsafe manner and can be leveraged for XXE attacks (e.g., File Exfiltration, Server Side Request Forgery,…
- risk 0.57cvss 9.8epss 0.02
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
- risk 0.57cvss 8.8epss 0.02
Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- risk 0.57cvss 9.8epss 0.02
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.
- risk 0.57cvss 8.8epss 0.01
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).
- risk 0.57cvss 8.8epss 0.01
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.
- risk 0.57cvss 9.8epss 0.02
petl before 1.68, in some configurations, allows resolution of entities in an XML document.
- risk 0.57cvss 8.8epss 0.02
A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial…
- risk 0.57cvss 9.8epss 0.07
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
- risk 0.57cvss 8.8epss 0.01
Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- risk 0.57cvss 9.8epss 0.02
AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.