CWE-611
Improper Restriction of XML External Entity Reference
Description
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Hierarchy (View 1000)
Parents
Children
none
Related attack patterns (CAPEC)
CAPEC-221
CVEs mapped to this weakness (684)
page 32 of 35| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-2092 | 0.00 | — | 0.01 | Jan 15, 2020 | Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents. | |||
| CVE-2015-8549 | — | 0.00 | — | 0.01 | Jan 15, 2020 | XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload. | ||
| CVE-2019-16549 | 0.00 | — | 0.01 | Dec 17, 2019 | Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents. | |||
| CVE-2014-3643 | 0.00 | — | 0.02 | Dec 15, 2019 | jersey: XXE via parameter entities not disabled by the jersey SAX parser | |||
| CVE-2019-17554 | 0.00 | — | 0.12 | Dec 4, 2019 | The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks. | |||
| CVE-2019-10080 | — | 0.00 | — | 0.02 | Nov 19, 2019 | The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and… | ||
| CVE-2019-10172 | — | 0.00 | — | 0.17 | Nov 18, 2019 | A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes. | ||
| CVE-2014-3599 | — | 0.00 | — | 0.01 | Nov 12, 2019 | HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy | ||
| CVE-2019-12331 | — | 0.00 | — | 0.01 | Nov 7, 2019 | PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By… | ||
| CVE-2019-8126 | 0.00 | — | 0.01 | Nov 5, 2019 | An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow… | |||
| CVE-2019-12415 | 0.00 | — | 0.01 | Oct 23, 2019 | In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE)… | |||
| CVE-2019-10466 | 0.00 | — | 0.01 | Oct 23, 2019 | An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service… | |||
| CVE-2019-15160 | — | 0.00 | — | 0.02 | Aug 19, 2019 | The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD. | ||
| CVE-2019-13990 | — | 0.00 | — | 0.16 | Jul 26, 2019 | initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. | ||
| CVE-2015-3907 | — | 0.00 | — | 0.02 | Jul 3, 2019 | CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks. | ||
| CVE-2019-10337 | 0.00 | — | 0.02 | Jun 11, 2019 | An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins… | |||
| CVE-2019-10327 | 0.00 | — | 0.01 | May 31, 2019 | An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses… | |||
| CVE-2019-0188 | 0.00 | — | 0.08 | May 28, 2019 | Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed. | |||
| CVE-2019-10309 | 0.00 | — | 0.02 | Apr 30, 2019 | Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attackers on the same network to read arbitrary files from Swarm… | |||
| CVE-2019-9843 | 0.00 | — | 0.01 | Mar 15, 2019 | In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents… |
- CVE-2020-2092Jan 15, 2020risk 0.00cvss —epss 0.01
Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents.
- CVE-2015-8549Jan 15, 2020risk 0.00cvss —epss 0.01
XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.
- CVE-2019-16549Dec 17, 2019risk 0.00cvss —epss 0.01
Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents.
- CVE-2014-3643Dec 15, 2019risk 0.00cvss —epss 0.02
jersey: XXE via parameter entities not disabled by the jersey SAX parser
- CVE-2019-17554Dec 4, 2019risk 0.00cvss —epss 0.12
The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks.
- CVE-2019-10080Nov 19, 2019risk 0.00cvss —epss 0.02
The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and…
- CVE-2019-10172Nov 18, 2019risk 0.00cvss —epss 0.17
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
- CVE-2014-3599Nov 12, 2019risk 0.00cvss —epss 0.01
HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy
- CVE-2019-12331Nov 7, 2019risk 0.00cvss —epss 0.01
PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By…
- CVE-2019-8126Nov 5, 2019risk 0.00cvss —epss 0.01
An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow…
- CVE-2019-12415Oct 23, 2019risk 0.00cvss —epss 0.01
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE)…
- CVE-2019-10466Oct 23, 2019risk 0.00cvss —epss 0.01
An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service…
- CVE-2019-15160Aug 19, 2019risk 0.00cvss —epss 0.02
The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD.
- CVE-2019-13990Jul 26, 2019risk 0.00cvss —epss 0.16
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
- CVE-2015-3907Jul 3, 2019risk 0.00cvss —epss 0.02
CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks.
- CVE-2019-10337Jun 11, 2019risk 0.00cvss —epss 0.02
An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins…
- CVE-2019-10327May 31, 2019risk 0.00cvss —epss 0.01
An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses…
- CVE-2019-0188May 28, 2019risk 0.00cvss —epss 0.08
Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.
- CVE-2019-10309Apr 30, 2019risk 0.00cvss —epss 0.02
Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attackers on the same network to read arbitrary files from Swarm…
- CVE-2019-9843Mar 15, 2019risk 0.00cvss —epss 0.01
In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents…