Improper Restriction of XML External Entity Reference
CWE-611
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
We track 348 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 9 have been exploited in real attacks.
How this weakness is prevented
- Implementation System Configuration: Many XML parsers and validators can be configured to disable external entity expansion.
Latest Improper Restriction of XML External Entity Reference vulnerabilities
- 7.5 High severity
fonttools: Improper Restriction of XML External Entity Reference
fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG ta
- 9.8 Critical severity
Unified Remote: Improper Restriction of XML External Entity Reference
Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint.
- 7.5 High severity
52North WPS: Improper Restriction of XML External Entity Reference
An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP r
- 7.5 High severity
WSO2 API Manager: Improper Restriction of XML External Entity Reference
Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.
- 7.5 High severity
Repox: Improper Restriction of XML External Entity Reference
An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the fileupload function, resulting in interaction between the attacker and the server's file system.
- 7.1 High severity
Eclipse Memory Analyzer (tools.mat): Improper Restriction of XML External Entity Reference
In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) references to external entities. This means that if a user chooses to use a malicious report definition XML file containi
- 9.8 Critical severity
Apache Cocoon: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.
- 7.5 High severity
RoboHelp: Improper Restriction of XML External Entity Reference
Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to information disclosure by an unauthenticated attacker. Exploitation of this issue does not require
- 7.5 High severity
Siemens OPC UA Modelling Editor (SiOME): Improper Restriction of XML External Entity Reference
A vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions < V2.8). Affected products suffer from a XML external entity (XXE) injection vulnerability. This vulnerability could allow an attacker to interfere with an application
- 9.8 Critical severity
Opencrx: Improper Restriction of XML External Entity Reference
An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory.
- 7.5 High severity
North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Exploited
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a sp
- 9.1 Critical severity
Security Directory Server: Improper Restriction of XML External Entity Reference
IBM Security Directory Server 6.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228505.
- 7.5 High severity
endpoint_manager: Improper Restriction of XML External Entity Reference
An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure
- 7.4 High severity
MIM Assistant: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity Linking / XML External Entities Blowup. In order to take advantage of this vulnerability, an attacker must craft a mali
- 8.8 High severity
Jenkins Job Configuration History Plugin: Improper Restriction of XML External Entity Reference
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- 9.1 Critical severity
Financial Transaction Manager for SWIFT Services: Improper Restriction of XML External Entity Reference
IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- 7.5 High severity
cs310: Improper Restriction of XML External Entity Reference
Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e., '*' indicates that the full version specification varies across product model family, but firmware
- 9.8 Critical severity
leshan: Improper Restriction of XML External Entity Reference
Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser` and `DefaultDDFFileValidator` (and so `ObjectLoader`) are vulnerable to `XXE Attacks`. A DDF file is a LWM2M format used to store LWM2M object desc
- 9.8 Critical severity
Python: Improper Restriction of XML External Entity Reference
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
- 8.2 High severity
Apache Ivy: XML Injection
Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files
- 7.5 High severity
PHP: Improper Restriction of XML External Entity Reference
In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the use
- 8.8 High severity
HCL Unica Platform: Improper Restriction of XML External Entity Reference
The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.
- 9.1 Critical severity
J Wbem: Improper Restriction of XML External Entity Reference
In WS-Inc J WBEM Server 4.7.4 before 4.7.5, the CIM-XML protocol adapter does not disable entity resolution. This allows context-dependent attackers to read arbitrary files or cause a denial of service, a similar issue to CVE-2013-4152.
- 10.0 Critical severity
kirby: Improper Restriction of XML External Entity Reference
Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plug
- 9.8 Critical severity
Android: Improper Restriction of XML External Entity Reference
In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.5 High severity
Lenovo XClarity Administrator: Improper Restriction of XML External Entity Reference
An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files.
- 7.5 High severity
HuTool: Improper Restriction of XML External Entity Reference
A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity re
- 7.5 High severity
XML Library: Improper Restriction of XML External Entity Reference
The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.
- 7.1 High severity
Archive Center Administration: Improper Restriction of XML External Entity Reference
The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client (Versions 16.2.3, 21.2, and older versions) could upload XML files to the application that it did not
- 8.8 High severity
e-cology: Improper Restriction of XML External Entity Reference
A vulnerability classified as problematic was found in Weaver e-cology up to 9.0. Affected by this vulnerability is the function RequestInfoByXml of the component API. The manipulation leads to xml external entity reference. The associated identifier of this v
- 9.1 Critical severity
WebSphere Application Server: Improper Restriction of XML External Entity Reference
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID
- 7.5 High severity
Shinseiyo Sogo Soft: Improper Restriction of XML External Entity Reference
Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.
- 8.1 High severity
Workload Automation: Improper Restriction of XML External Entity Reference
HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- 8.1 High severity
Workload Automation: Improper Restriction of XML External Entity Reference
HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- 7.5 High severity
Man-eam-0003: Improper Restriction of XML External Entity Reference
cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file upload, which leads to local file disclosure.
- 7.5 High severity
Polarion ALM: Improper Restriction of XML External Entity Reference
A vulnerability has been identified in Polarion ALM (All versions < V22R2). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on the application server filesystem.
- 7.1 High severity
TRIRIGA Application Platform: Improper Restriction of XML External Entity Reference
IBM TRIRIGA 4.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249975.
- 7.1 High severity
Edge: Improper Restriction of XML External Entity Reference
This vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious pag
- 9.8 Critical severity
Jodf: Improper Restriction of XML External Entity Reference
An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file.
- 9.8 Critical severity
Jspreadsheet: Improper Restriction of XML External Entity Reference
An issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file.