Weakness (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

Base Draft

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

How to prevent it (1 mitigation)

Implementation, System Configuration

Many XML parsers and validators can be configured to disable external entity expansion.

Source: MITRE CWE-611

All Critical High Medium Low Exploited only Public exploit

942 results · Feed

High 7.5

CVE-2021-28965

REXML round-trip instability

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems

Apr 21, 2021
High 7.1

CVE-2021-29447 Public exploit EPSS 86%

WordPress Authenticated XXE attack when installation is running PHP 8

Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possibl…

WordPress wordpress-develop wordpress wordpress Web / CMS Debian Ubuntu

Apr 15, 2021
High 7.7

CVE-2021-27604

In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integrati…

SAP SAP Process Integration (Enterprise Service Repository JAVA Mappings)

Apr 14, 2021
Unscored —

CVE-2020-6590

Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information di…

Apr 8, 2021
High 7.5

CVE-2021-29421

Improper Restriction of XML External Entity Reference in pikepdf

models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.

pikepdf py3-pikepdf pikepdf pikepdf Debian Ubuntu Alpine PyPI

Apr 1, 2021
Unscored —

CVE-2020-28387

A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions <…

Siemens Solid Edge SE2021 Solid Edge SE2020 Browsers ICS / OT

Mar 15, 2021
High 7.2

CVE-2021-21517

SRS Policy Manager 6.X is affected by an XML External Entity Injection (XXE) vulnerability due to a misconfigured XML p…

Dell SRS Policy Manager

Mar 1, 2021
Medium 6.1

CVE-2019-18943

XML External Entity processing

Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations.

Micro Focus Solutions Business Manager

Feb 26, 2021
Medium 6.4

CVE-2021-21266

XXE vulnerability in OpenHAB

openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before versions 2.5.12 and 3.0.1 the XML external entity (XXE) attack allows attackers in the same network as the openHAB instance to retrieve internal infor…

openhab openhab-addons

Feb 1, 2021
Critical 9.1

CVE-2021-23901

An XML external entity (XXE) injection vulnerability exists in the Nutch DmozParser

An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere wi…

Apache Software Foundation Apache Nutch org.apache.nutch:nutch Maven

Jan 25, 2021
High 7.5

CVE-2020-27858 EPSS 74%

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D…

Arcserve D2D

Jan 20, 2021
Critical 9.8

CVE-2021-23899

Arbitrary code injection in json-sanitizer

OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.

com.mikesamuel:json-sanitizer Maven

Jan 13, 2021
Unscored —

CVE-2020-26981

A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0…

Siemens JT2Go Teamcenter Visualization ICS / OT

Jan 12, 2021
High 8.8

CVE-2020-28736

Improper Restriction of XML External Entity Reference in Plone

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).

plone plone-app-event plone-app-dexterity plone-supermodel PyPI

Dec 30, 2020
High 8.8

CVE-2020-28734

Improper Restriction of XML External Entity Reference in Plone

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.

plone plone-app-event plone-app-dexterity plone-app-theming PyPI

Dec 30, 2020
Low 2.6

CVE-2020-26247

XXE in Nokogiri

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external …

sparklemotion nokogiri nokogiri ruby-nokogiri Debian Ubuntu Alpine RubyGems

Dec 30, 2020
High 7.5

CVE-2020-25649 EPSS 18%

XML External Entity (XXE) Injection in Jackson Databind

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Dec 3, 2020
High 7.5

CVE-2020-2324

XXE vulnerability in Jenkins CVS Plugin

Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins CVS Plugin org.jenkins-ci.plugins:cvs Web / CMS Maven

Dec 3, 2020
Critical 9.8

CVE-2020-29128

XXE in petl

petl before 1.68, in some configurations, allows resolution of entities in an XML document.

petl PyPI

Nov 26, 2020
Low 3.7

CVE-2020-26229

XML External Entity in Dashboard Widget

TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possibl…

TYPO3 TYPO3 CMS typo3/cms typo3/cms-core Web / CMS Packagist

Nov 23, 2020
Unscored —

CVE-2020-7572

A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation …

Nov 19, 2020
Medium 6.5

CVE-2020-7032

Avaya WebLM Improper Restriction of XML External Entity Reference

An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Avaya WebLM include: 7…

Avaya WebLM System Manager

Nov 13, 2020
Medium 6.5

CVE-2020-2315

XXE vulnerability in Jenkins Visualworks Store Plugin

Jenkins Visualworks Store Plugin 1.1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Visualworks Store Plugin org.jenkins-ci.plugins:visualworks-store Web / CMS Maven

Nov 4, 2020
Medium 6.5

CVE-2020-2305

XXE vulnerability in Jenkins Mercurial Plugin

Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Mercurial Plugin org.jenkins-ci.plugins:mercurial Web / CMS Maven

Nov 4, 2020
Medium 6.5

CVE-2020-2304

XXE vulnerability in Jenkins Subversion Plugin

Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Subversion Plugin subversion org.jenkins-ci.plugins:subversion Web / CMS Azure Linux Maven

Nov 4, 2020
Medium 5.6

GHSA-8xv9-qcr9-ww9j

Authenticated XML External Entity Processing

### Impact Authenticated XML External Entity Processing ### Patches We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/down…

shopware/platform shopware/core Packagist

Oct 19, 2020
Medium 6.5

CVE-2020-2298

XXE vulnerability in Jenkins Nerrvana Plugin

Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Nerrvana Plugin org.jenkins-ci.plugins:nerrvana-plugin Web / CMS Maven

Oct 8, 2020
Critical 9.3

CVE-2020-15232

XML External Entity attack in mapfish-print

In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.

mapfish mapfish-print org.mapfish.print:print-lib org.mapfish.print:print-servlet Maven

Oct 2, 2020
Medium 5.5

CVE-2020-13940

Improper Restriction of XML External Entity Reference in Apache NiFi

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make ext…

org.apache.nifi:nifi Maven

Oct 1, 2020
Unscored —

CVE-2020-8256

A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain…

Sep 29, 2020
High 7.1

CVE-2020-2284

XXE vulnerability in Jenkins Liquibase Runner Plugin

Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Liquibase Runner Plugin org.jenkins-ci.plugins:liquibase-runner Web / CMS Maven

Sep 23, 2020
High 7.5

CVE-2020-25750

DotPlant2 Improper Restriction of XML External Entity Reference

An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NO…

devgroup/dotplant Packagist

Sep 18, 2020
High 7.5

CVE-2020-17408 EPSS 71%

This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCl…

NEC ExpressCluster

Sep 10, 2020
High 7.1

CVE-2020-2247

XXE vulnerability in Jenkins Klocwork Analysis Plugin

Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Klocwork Analysis Plugin org.jenkins-ci.plugins:klocwork Web / CMS Maven

Sep 1, 2020
High 7.1

CVE-2020-2245

XXE vulnerability in Jenkins Valgrind Plugin

Jenkins Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Valgrind Plugin org.jenkins-ci.plugins:valgrind Web / CMS Maven

Sep 1, 2020
Critical 9.8

CVE-2020-25020

Improper Restriction of XML External Entity Reference in MPXJ

MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components.

net.sf.mpxj:mpxj Maven

Aug 29, 2020
High 8.3

CVE-2020-17376

OpenStack Nova Live migration fails to update persistent domain XML

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination h…

nova nova nova Debian Ubuntu PyPI

Aug 26, 2020
High 7.5

CVE-2020-15419 EPSS 60%

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.…

Veeam One

Jul 28, 2020
High 7.5

CVE-2020-15418

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.…

Veeam One

Jul 28, 2020
Medium 6.5

CVE-2020-3405

Cisco SD-WAN vManage Software XML External Entity Vulnerability

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entit…

Cisco Cisco SD-WAN vManage Network devices

Jul 16, 2020