Skip to content
OpenAdvisories

Weakness (CWE)

CWE-112: Missing XML Validation

Base Draft

The product accepts XML from an untrusted source but does not validate the XML against the proper schema.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Always validate XML input against a known XML Schema or DTD.

    It is not possible for an XML parser to validate all aspects of a document's content because a parser cannot understand the complete semantics of the data. However, a parser can do a complete and thorough job of checking the document's structure and therefore guarantee to the code that processes the document that the content is well-formed.

Source: MITRE CWE-112

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.5
    CVE-2023-40310

    Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import

    SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file, although not used, would be accessed during import. A successful attack could i…

    SAP_SE SAP PowerDesigner Client
  • Medium 5.3
    CVE-2021-27780

    HCL BigFix Mobile / Modern Client Management is vulnerable to unauthenticated XML interaction

    The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.

    HCL Software HCL BigFix Mobile / Modern Client Management
  • Medium 6.3
    CVE-2021-1359

    Cisco Web Security Appliance Privilege Escalation Vulnerability

    A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient valida…

    Cisco Cisco Web Security Appliance (WSA) Network devices
  • Medium 6.8
    CVE-2020-1975

    Missing XML Validation in PAN-OS Web Interface

    Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 a…

    Palo Alto Networks PAN-OS Network devices
  • Medium —
    CVE-2014-0119

    Missing XML Validation in Apache Tomcat

    Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web applicatio…

    org.apache.tomcat:tomcat tomcat7 tomcat6 org.apache.tomcat:tomcat-catalina Ubuntu Maven
  • Medium —
    CVE-2013-7315

    Missing XML Validation in Spring Framework

    The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CS…

    libspring-java org.springframework:spring-oxm Debian Maven
  • Medium —
    CVE-2013-2160 Public exploit EPSS 32%

    Missing XML Validation in Apache CXF

    The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) n…

    org.apache.cxf:cxf-rt-frontend-jaxrs Maven