Skip to content
OpenAdvisories

Weakness (CWE)

CWE-776: Improper Restriction of Recursive Entity References in DTDs

Base Draft

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

How to prevent it (2 mitigations)

  1. Operation

    If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.

  2. Implementation

    Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.

Source: MITRE CWE-776

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.8
    CVE-2023-38490 Public exploit

    Kirby XML External Entity (XXE) vulnerability in the XML data handler

    Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plu…

    getkirby kirby getkirby/cms Packagist
  • Medium —
    CVE-2015-5161 Public exploit

    ZendXml and Zend Framework contain XXE and XEE Vulnerabilities

    The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external e…

    zendframework/zendframework1 zendframework/zendframework zendframework/zendxml Packagist