Improper Restriction of XML External Entity Reference
CWE-611
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
We track 348 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 9 have been exploited in real attacks.
How this weakness is prevented
- Implementation System Configuration: Many XML parsers and validators can be configured to disable external entity expansion.
Latest Improper Restriction of XML External Entity Reference vulnerabilities
- 9.8 Critical severity
Jword: Improper Restriction of XML External Entity Reference
An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file.
- 8.8 High severity
Aspera Faspex: Improper Restriction of XML External Entity Reference
IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845.
- 7.5 High severity
OWSLib: Improper Restriction of XML External Entity Reference
OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and
- 7.7 High severity
xwiki-platform: Improper Restriction of XML External Entity Reference
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a document can trigger an XAR import on a forged XAR file, leading to the ability to display the content
- 9.8 Critical severity
Urule: Improper Restriction of XML External Entity Reference
An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /urule/common/saveFile.
- 8.8 High severity
VMware vRealize Orchestrator, VMware vRealize…: Improper Restriction of XML External Entity Reference
VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sen
- 9.1 Critical severity
FortiNAC: Improper Restriction of XML External Entity Reference
An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11, FortiNAC version 8.7.0 through 8.7.6,
- 8.1 High severity
apoc: Improper Restriction of XML External Entity Reference
APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 and 4.4.0.14 (4.4 branch) in Neo4j graph database. XML External
- 7.4 High severity
tsClinical Define.xml Generator and tsClinical…: Improper Restriction of XML External Entity Reference
Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinical Metadata Desktop Tools Version 1.0.3 to Version 1.1.0. If this vulnerability is exploited, an att
- 7.8 High severity
Ureport: Improper Restriction of XML External Entity Reference
An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.
- 7.5 High severity
Apache NiFi: Improper Restriction of XML External Entity Reference
The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type
- 7.8 High severity
Remote Engine Gen 2: Improper Restriction of XML External Entity Reference
All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks. Users should download the R2022-09 release or later and use it in place of the previous version. Talend Remote Engine Gen 1 an
- 9.1 Critical severity
Tivoli Workload Scheduler: Improper Restriction of XML External Entity Reference
IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Forc
- 9.1 Critical severity
Tivoli Workload Scheduler: Improper Restriction of XML External Entity Reference
IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Forc
- 9.8 Critical severity
Jenkins Semantic Versioning Plugin: Improper Restriction of XML External Entity Reference
Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins p
- 8.1 High severity
Web Services Manager: Improper Restriction of XML External Entity Reference
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: XML Security component). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access
- 7.5 High severity
Device Registration Portal: Improper Restriction of XML External Entity Reference
BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, such as "machine example.com login daniel password qwerty" in the documentation example for the .netrc file format. NOTE:
- 7.5 High severity
Dragonfly: Improper Restriction of XML External Entity Reference
Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses X
- 9.8 Critical severity
OGC Web Feature Service: Improper Restriction of XML External Entity Reference
A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to addr
- 8.8 High severity
Xml-rpc.net: Improper Restriction of XML External Entity Reference
An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, as demonstrated by a pingback.aspx POST request.
- 9.8 Critical severity
Sophos Mobile managed on-premises: Improper Restriction of XML External Entity Reference
An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.
- 7.2 High severity
Trellix IPS Manager: Improper Restriction of XML External Entity Reference
XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE attack in the administrator interface part of the interface, which allows a saved XML configuration file to be imported.
- 7.5 High severity
CandidATS: Improper Restriction of XML External Entity Reference
CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE.
- 9.1 Critical severity
IBM InfoSphere Information Server: Improper Restriction of XML External Entity Reference
"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 236
- 9.1 Critical severity
VMware Cloud Foundation (NSX-V): Improper Restriction of XML External Entity Reference
VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure.
- 7.5 High severity
ColdFusion: Improper Restriction of XML External Entity Reference
Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not req
- 7.5 High severity
ColdFusion: Improper Restriction of XML External Entity Reference
Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not req
- 9.8 Critical severity
Netbackup: Improper Restriction of XML External Entity Reference
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) Injection attack through the DiscoveryService service.
- 8.8 High severity
Netbackup: Improper Restriction of XML External Entity Reference
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) injection attack through the nbars process.
- 7.1 High severity
Partner Engagement Manager: Improper Restriction of XML External Entity Reference
IBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID:
- 7.5 High severity
Apache SOAP: Improper Restriction of XML External Entity Reference
An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versio
- 9.8 Critical severity
Data Loss Prevention (DLP): Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled,
- 9.8 Critical severity
Apache Calcite: Improper Restriction of XML External Entity Reference
Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefor
- 7.5 High severity
Mei2volpiano: Improper Restriction of XML External Entity Reference
DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input.
- 8.1 High severity
Cognos Analytics: Improper Restriction of XML External Entity Reference
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force
- 8.6 High severity
Delta Robot Automation Studio (DRAS): Improper Restriction of XML External Entity Reference
Delta Electronics Delta Robot Automation Studio (DRAS) versions prior to 1.13.20 are affected by improper restrictions where the software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere
- 7.5 High severity
prosody: Improper Restriction of XML External Entity Reference
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776)
- 9.1 Critical severity
MQ: Improper Restriction of XML External Entity Reference
IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM
- 8.2 High severity
Red Hat Process Automation Manager 7: Improper Restriction of XML External Entity Reference
XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML pars
- 9.8 Critical severity
Ignition: Improper Restriction of XML External Entity Reference
Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup.