CWE-611— Improper Restriction of XML External Entity Reference (XXE)

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog

1,348 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-611page 21 of 27

CVE-2021-43576MEDIUMCVSS 6.5EG 6.5
2021-11-12
Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses ext…
CVE-2021-21701MEDIUMCVSS 6.5EG 6.5
2021-11-12
Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-20839MEDIUMCVSS 6.5EG 6.5
2021-11-01
Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition to the other servers by proce…
CVE-2021-20801MEDIUMCVSS 6.5EG 6.5
2021-10-13
Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to conduct XML External Entity (XXE) attacks and obtain the information stored in the product via unspecified vectors. This issue occurs only when using Mozilla Fi…
CVE-2021-3312MEDIUMCVSS 6.5EG 6.5
2021-10-08
An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
CVE-2021-40439MEDIUMCVSS 6.5EG 6.5
2021-10-07
Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML f…
CVE-2021-35201MEDIUMCVSS 6.5EG 6.5
2021-09-30
NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks.
CVE-2021-3055MEDIUMCVSS 6.5EG 6.5
2021-09-08
An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system and send a specifically craf…
CVE-2020-26564MEDIUMCVSS 6.5EG 6.5
2021-07-31
ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey template (containing a link to this .css file), and import this .xml file at the surve…
CVE-2021-27635MEDIUMCVSS 6.5EG 6.5
2021-06-09
SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator to connect over a network and submit a specially crafted XML file in the application because of missing XML Validation…
CVE-2021-32925MEDIUMCVSS 6.5EG 6.5
2021-05-13
admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities.
CVE-2020-36124MEDIUMCVSS 6.5EG 6.5
2021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by XML External Entity (XXE) injection. An authenticated attacker can compromise the private keys of a JWT token and reuse them to manipulate the access tokens to access t…
CVE-2021-25164MEDIUMCVSS 6.5EG 6.5
2021-04-28
A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
CVE-2021-27736MEDIUMCVSS 6.5EG 6.5
2021-04-22
FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely.
CVE-2021-27604MEDIUMCVSS 6.5EG 6.5
2021-04-14
In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Service Repository JAVA Mappings), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, SAP recommends to refe…
CVE-2021-26969MEDIUMCVSS 6.5EG 6.5
2021-03-05
A remote authenticated authenticated xml external entity (xxe) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Due to improper restrictions on XML entities a vulnerability exists in the web-…
CVE-2020-26981MEDIUMCVSS 6.5EG 6.5
2021-01-12
A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). When opening a specially crafted xml file, the application could disclose arbitrary files to remote attackers. This i…
CVE-2020-35123MEDIUMCVSS 6.5EG 6.5
2020-12-17
In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This has been fixed in Zimbra Collaboration Suit…
CVE-2020-29436MEDIUMCVSS 6.5EG 6.5
2020-12-17
Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0.
CVE-2020-7032MEDIUMCVSS 6.5EG 6.5
2020-11-13
An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Av…
CVE-2020-2298MEDIUMCVSS 6.5EG 6.5
2020-10-08
Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2020-2247MEDIUMCVSS 6.5EG 6.5
2020-09-01
Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2020-24656MEDIUMCVSS 6.5EG 6.5
2020-08-26
Maltego before 4.2.12 allows XXE attacks.
CVE-2020-24591MEDIUMCVSS 6.5EG 6.5
2020-08-21
The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, …
CVE-2020-8541MEDIUMCVSS 6.5EG 6.5
2020-06-16
OX App Suite through 7.10.3 allows XXE attacks.
CVE-2019-17020MEDIUMCVSS 6.5EG 6.5
2020-01-08
If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would…
CVE-2019-3768MEDIUMCVSS 6.5EG 6.5
2020-01-03
RSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to cause information disclosure of local system files by …
CVE-2019-11216MEDIUMCVSS 6.5EG 6.5
2019-12-04
BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. X…
CVE-2019-10080MEDIUMCVSS 6.5EG 6.5
2019-11-19
The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information su…
CVE-2019-17085MEDIUMCVSS 6.5EG 6.5
2019-11-18
XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. The vulnerability could be exploited to do an XXE attack on Operations Agent.
CVE-2014-3599MEDIUMCVSS 6.5EG 6.5
2019-11-12
HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy
CVE-2019-14276MEDIUMCVSS 6.5EG 6.5
2019-10-23
WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body.
CVE-2019-12711MEDIUMCVSS 6.5EG 6.5
2019-10-02
A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to access sensitive information or…
CVE-2019-15641MEDIUMCVSS 6.5EG 6.5
2019-08-26
xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi.
CVE-2019-1010202MEDIUMCVSS 6.5EG 6.5
2019-07-23
Jeesite 1.2.7 is affected by: XML External Entity (XXE). The impact is: sensitive information disclosure. The component is: convertToModel() function in src/main/java/com.thinkgem.jeesite/modules/act/service/ActProcessService.java. The att…
CVE-2018-17289MEDIUMCVSS 6.5EG 6.5
2019-04-18
An XML external entity (XXE) vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to read arbitrary files via crafted XML inside an imported package configuration (.ZIP…
CVE-2017-18110MEDIUMCVSS 6.5EG 6.5
2019-03-29
The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read files from the filesystem via a XXE vulnerability.
CVE-2019-0277MEDIUMCVSS 6.5EG 6.5
2019-03-12
SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privileges to the SAP space (XML External Entity vulnerability).
CVE-2018-20233MEDIUMCVSS 6.5EG 6.5
2019-01-18
The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML…
CVE-2018-19371MEDIUMCVSS 6.5EG 6.5
2019-01-02
The SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that allows reading sensitive files from the system.
CVE-2018-1000840MEDIUMCVSS 6.5EG 6.5
2018-12-20
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This…
CVE-2018-20298MEDIUMCVSS 6.5EG 6.5
2018-12-19
S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server via the S3 protocol.
CVE-2017-7545MEDIUMCVSS 6.5EG 6.5
2018-07-26
It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application s…
CVE-2018-5433MEDIUMCVSS 6.5EG 6.5
2018-06-13
The TIBCO Administrator server component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains vulnerabilities wherein a malicious user could perform XML extern…
CVE-2018-1000198MEDIUMCVSS 6.5EG 6.5
2018-06-05
A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read permission to make Jenkins process XML eternal entities in an XM…
CVE-2017-15691MEDIUMCVSS 6.5EG 6.5
2018-04-26
In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE…
CVE-2018-10175MEDIUMCVSS 6.5EG 6.5
2018-04-20
Digital Guardian Management Console 7.1.2.0015 has an XXE issue.
CVE-2015-7461MEDIUMCVSS 6.5EG 6.5
2018-03-20
XML external entity (XXE) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote authenticated users to cause a denial of service (memory consumption) via crafted XML data. IBM X-Force ID: 108357.
CVE-2018-5758MEDIUMCVSS 6.5EG 6.5
2018-03-12
The Upload File functionality in upload.jspa in Aurea Jive Jive-n 9.0.2.1 On-Premises allows for an XML External Entity attack through a crafted file, allowing attackers to read arbitrary files.
CVE-2018-3600MEDIUMCVSS 6.5EG 6.5
2018-02-09
A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to disclose sensitive information on vulnerable installations.

Map vulnerabilities like CWE-611 to your infrastructure

EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →