Skip to content
OpenAdvisories

Weakness (CWE)

CWE-776: Improper Restriction of Recursive Entity References in DTDs

Base Draft

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

How to prevent it (2 mitigations)

  1. Operation

    If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.

  2. Implementation

    Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.

Source: MITRE CWE-776

All Critical High Medium Low Exploited only Public exploit

0 results · Clear filters · Feed

Nothing found.