Improper Restriction of XML External Entity Reference
CWE-611
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
We track 348 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 9 have been exploited in real attacks.
How this weakness is prevented
- Implementation System Configuration: Many XML parsers and validators can be configured to disable external entity expansion.
Latest Improper Restriction of XML External Entity Reference vulnerabilities
- 8.0 High severity
OpenText Application Automation Tools: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.
- 8.0 High severity
OpenText Application Automation Tools: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.
- 8.0 High severity
OpenText Application Automation Tools: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.
- 8.8 High severity
PeopleSoft Enterprise PeopleTools: Improper Restriction of XML External Entity Reference
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: XMLPublisher). Supported versions that are affected are 8.59, 8.60 and 8.61. Easily exploitable vulnerability allows low privileged attacker with network access via
- 7.5 High severity
Apache XML Graphics FOP: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue.
- 7.5 High severity
PhpSpreadsheet: Improper Restriction of XML External Entity Reference
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allo
- 7.5 High severity
dataease: Improper Restriction of XML External Entity Reference
DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detecti
- 9.8 Critical severity
app-referencevalidator: Improper Restriction of XML External Entity Reference
The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The profile location routine in the referencevalidator commons package is vulnerable to `XML External Entities` attack due to
- 9.8 Critical severity
ww.Winsure: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection. This issue affects ww.Winsure: before 4.6.2.
- 8.2 High severity
EPM: Improper Restriction of XML External Entity Reference
An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.
- 8.6 High severity
org.hl7.fhir.core: Improper Restriction of XML External Entity Reference
The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various com
- 8.8 High severity
xml_jdbc: Improper Restriction of XML External Entity Reference
XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying s
- 7.5 High severity
Journyx (jtime): Improper Restriction of XML External Entity Reference
The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.
- 8.8 High severity
Apache Drill: Improper Restriction of XML External Entity Reference
XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue.
- 8.2 High severity
Engineering Requirements Management DOORS: Improper Restriction of XML External Entity Reference
IBM Engineering Requirements Management DOORS Web Access 9.7.2.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resou
- 7.5 High severity
cyclonedx-core-java: Improper Restriction of XML External Entity Reference
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions t
- 7.2 High severity
SAST: Improper Restriction of XML External Entity Reference
When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application (either on-premises or cloud/SaaS solution), the transmitted data consists of a ZIP archive containing several files, some of them in the XML file format. During Kiuwan'
- 9.8 Critical severity
Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Exploited
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability b
- 9.1 Critical severity
lxml: Improper Restriction of XML External Entity Reference
An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.
- 7.5 High severity
Ebookmeta: Improper Restriction of XML External Entity Reference
An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.
- 8.2 High severity
Engineering Requirements Management DOORS Next: Improper Restriction of XML External Entity Reference
IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory res
- 9.8 Critical severity
iManager: Improper Restriction of XML External Entity Reference
XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to remote code execution by parsing untrusted XML payload
- 9.8 Critical severity
iManager: Improper Restriction of XML External Entity Reference
XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to information disclosure and remote code execution.
- 8.1 High severity
cyclonedx-javascript-library: Improper Restriction of XML External Entity Reference
The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1.
- 7.5 High severity
ViewPower Pro: Improper Restriction of XML External Entity Reference
Voltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower Pro. Authenticatio
- 8.2 High severity
D-View: Improper Restriction of XML External Entity Reference
D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of D-Link D-View. Authentication is not required to exploit th
- 7.5 High severity
Simple Editor: Improper Restriction of XML External Entity Reference
LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to expl
- 7.5 High severity
Simple Editor: Improper Restriction of XML External Entity Reference
LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to expl
- 7.5 High severity
Simple Editor: Improper Restriction of XML External Entity Reference
LG Simple Editor saveXmlFile XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to expl
- 7.1 High severity
GMS: Improper Restriction of XML External Entity Reference
The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the disclosure of sensitive information. This issue affects GMS: 9.3.4 and earlier versions.
- 7.0 High severity
WebSphere Application Server: Improper Restriction of XML External Entity Reference
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to exp
- 9.8 Critical severity
BI Publisher (formerly XML Publisher): Improper Restriction of XML External Entity Reference
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to
- 8.8 High severity
EasyAdmin: Improper Restriction of XML External Entity Reference
A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The attack can be initiate
- 8.2 High severity
Maximo Asset Management: Improper Restriction of XML External Entity Reference
IBM Maximo Application Suite 7.6.1.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 284566
- 7.5 High severity
OpenOLAT: Improper Restriction of XML External Entity Reference
OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using the draw.io integration it is possible to read arbitrary files as the configured system user and SS
- 8.2 High severity
Security Guardium Key Lifecycle Manager: Improper Restriction of XML External Entity Reference
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume m
- 8.7 High severity
Portal: Improper Restriction of XML External Entity Reference
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/port
- 8.3 High severity
ICS: Improper Restriction of XML External Entity Reference
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.
- 7.5 High severity
SAP NetWeaver AS Java (Guided Procedures): Improper Restriction of XML External Entity Reference
SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them.
- 7.1 High severity
Security Verify Access Appliance: Improper Restriction of XML External Entity Reference
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A re