Weakness (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

Base Draft

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

How to prevent it (1 mitigation)

Implementation, System Configuration

Many XML parsers and validators can be configured to disable external entity expansion.

Source: MITRE CWE-611

All Critical High Medium Low Exploited only Public exploit

397 results · Clear filters · Feed

High 7.5

CVE-2020-17408 EPSS 71%

This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCl…

NEC ExpressCluster

Sep 10, 2020
High 7.1

CVE-2020-2247

XXE vulnerability in Jenkins Klocwork Analysis Plugin

Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Klocwork Analysis Plugin org.jenkins-ci.plugins:klocwork Web / CMS Maven

Sep 1, 2020
High 7.1

CVE-2020-2245

XXE vulnerability in Jenkins Valgrind Plugin

Jenkins Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Valgrind Plugin org.jenkins-ci.plugins:valgrind Web / CMS Maven

Sep 1, 2020
High 8.3

CVE-2020-17376

OpenStack Nova Live migration fails to update persistent domain XML

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination h…

nova nova nova Debian Ubuntu PyPI

Aug 26, 2020
High 7.5

CVE-2020-15419 EPSS 60%

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.…

Veeam One

Jul 28, 2020
High 7.5

CVE-2020-15418

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.…

Veeam One

Jul 28, 2020
High 7.7

CVE-2020-13692

Improper Restriction of XML External Entity Reference

PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.

libpgjava libpgjava org.postgresql:postgresql mariadb-11.2 Debian Ubuntu Alpine Wolfi Maven

Jun 4, 2020
High 7.5

CVE-2020-2012

PAN-OS: Panorama: XML external entity reference ('XXE') vulnerability leads the to information leak

Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrary files on the syste…

Palo Alto Networks PAN-OS Network devices

May 13, 2020
High 7.5

CVE-2020-12642

XXE vulnerability in Launch import

An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.

com.epam.reportportal:service-api Maven

May 4, 2020
High 7.1

CVE-2020-2178

XXE vulnerability in Jenkins Parasoft Findings Plugin

Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Parasoft Findings Plugin com.parasoft:parasoft-findings Web / CMS Maven

Apr 16, 2020
High 7.1

CVE-2020-2172

XXE vulnerability in Jenkins Code Coverage API Plugin

Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Code Coverage API Plugin io.jenkins.plugins:code-coverage-api Web / CMS Maven

Apr 7, 2020
High 7.6

CVE-2020-2171

XXE vulnerability in Jenkins RapidDeploy Plugin

Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins RapidDeploy Plugin org.jenkins-ci.plugins:rapiddeploy-jenkins Web / CMS Maven

Mar 25, 2020
High 7.5

CVE-2020-9044

Metasys Improper Restriction of XML External Entity Reference

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and …

Johnson Controls Metasys Application and Data Server (ADS, ADS-Lite) Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) Metasys Open Data Server (ODS)

Mar 10, 2020
High 7.1

CVE-2020-2144

XXE vulnerability in Rundeck Plugin

Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Rundeck Plugin org.jenkins-ci.plugins:rundeck Web / CMS Maven

Mar 9, 2020
High 7.1

CVE-2020-2138

XXE vulnerability in Jenkins Cobertura Plugin

Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Cobertura Plugin org.jenkins-ci.plugins:cobertura Web / CMS Maven

Mar 9, 2020
High 8.6

CVE-2020-1693

A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api…

Red Hat spacewalk

Feb 17, 2020
High 7.6

CVE-2020-2120

XXE vulnerability in FitNesse Plugin

Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins FitNesse Plugin org.jenkins-ci.plugins:fitnesse Web / CMS Maven

Feb 12, 2020
High 7.6

CVE-2020-2115

XXE vulnerability in NUnit Plugin

Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins NUnit Plugin org.jenkins-ci.plugins:nunit Web / CMS Maven

Feb 12, 2020
High 7.6

CVE-2020-2108

XXE vulnerability in Jenkins WebSphere Deployer Plugin

Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissions.

Jenkins Project Jenkins WebSphere Deployer Plugin org.jenkins-ci.plugins:websphere-deployer Web / CMS Maven

Jan 29, 2020
High 7.5

CVE-2015-1809

XML external entity (XXE) vulnerability in Jenkins

XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.

CloudBees Jenkins Jenkins LTS org.jenkins-ci.main:jenkins-core Web / CMS Maven

Jan 15, 2020
High 7.6

CVE-2020-2092

XXE vulnerability in Jenkins Robot Framework Plugin

Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents.

Jenkins Project Jenkins Robot Framework Plugin org.jenkins-ci.plugins:robot Web / CMS Maven

Jan 15, 2020
High 7.1

CVE-2015-8549

PyAMF vulnerable to XML external entity (XXE)

XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.

pyamf PyPI

Jan 15, 2020
High 7.1

CVE-2019-16549

Jenkins Maven Release Plug-in Plugin XXE vulnerability

Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents.

Jenkins Project Jenkins Maven Release Plugin org.jenkins-ci.plugins.m2release:m2release Web / CMS Maven

Dec 17, 2019
High 8.1

CVE-2014-3643

jersey: XXE via parameter entities

jersey: XXE via parameter entities not disabled by the jersey SAX parser

jersey jersey com.sun.jersey:jersey-core Maven

Dec 15, 2019
High 8.8

CVE-2019-12331

XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficien…

phpoffice/phpspreadsheet phpoffice/phpexcel Packagist

Nov 7, 2019
High 8.1

CVE-2019-10466

Jenkins 360 FireLine Plugin vulnerable to XML External Entity Reference

An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or den…

Jenkins Project Jenkins 360 FireLine Plugin org.jenkins-ci.plugins.plugin:fireline Web / CMS Maven

Oct 23, 2019
High 7.5

CVE-2019-13608 Exploited · Ransomware Scanner template EPSS 30%

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE a…

Aug 29, 2019
KEV Nov 3, 2021
High 7.5

CVE-2019-15160

Inline DTD allows XML bomb attack

The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD.

sweet_xml Hex

Aug 19, 2019
High 7.5

CVE-2018-20843

In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the X…

insighttoolkit4 expat swish-e matanza Debian Ubuntu Alpine

Jun 24, 2019
High 7.5

CVE-2019-10337

Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin

An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets …

Jenkins Project Jenkins Token Macro Plugin org.jenkins-ci.plugins:token-macro Web / CMS Maven

Jun 11, 2019
High 8.1

CVE-2019-10327

XML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin

An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML …

Jenkins Project Jenkins Pipeline Maven Integration Plugin org.jenkins-ci.plugins:pipeline-maven Web / CMS Maven

May 31, 2019
High 7.5

CVE-2019-0188

XML External Entity injection in Apache Camel

Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.

Apache Apache Camel org.apache.camel:camel-core org.apache.camel:camel-xmljson Maven

May 28, 2019
High 7.5

CVE-2019-9843

Improper Restriction of XML External Entity Reference in DiffPlug Spotless

In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosur…

com.diffplug.spotless:spotless-plugin-gradle com.diffplug.spotless:spotless-maven-plugin Maven

Mar 15, 2019
High 8.1

CVE-2019-7722

Improper Restriction of XML External Entity Reference in PMD

PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, den…

net.sourceforge.pmd:pmd-core Maven

Feb 11, 2019
High 7.5

CVE-2018-20000

Improper Restriction of XML External Entity Reference in bedework:bw-webdav

Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java.

org.bedework:bw-webdav Maven

Dec 10, 2018
High 7.2

CVE-2018-17186

Improper Restriction of XML External Entity Reference in org.apache.syncope:syncope-core

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.

Apache Software Foundation Apache Syncope org.apache.syncope:syncope-core Maven

Nov 6, 2018
High 7.5

CVE-2018-11796

Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack

In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and …

Apache Software Foundation Apache Tika tika org.apache.tika:tika-core Ubuntu Maven

Oct 9, 2018
High 7.5

CVE-2018-11761 Public exploit

High severity vulnerability that affects org.apache.tika:tika-core

In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.

Apache Software Foundation Apache Tika tika tika Debian Ubuntu Maven

Sep 19, 2018
High 8.1

CVE-2018-11758

XML External Entity Reference in Apache Cayenne

This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2. CayenneModeler is a desktop GUI tool shipped with Apache Cayenne and intended for editing Cayenne ORM models stored as XML files. If an attacker tricks a…

Apache Software Foundation Apache Cayenne org.apache.cayenne:cayenne-parent Maven

Aug 22, 2018
High 8.7

CVE-2017-7464

It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE fl…

[UNKNOWN] jboss

Jul 27, 2018