CWE-611— Improper Restriction of XML External Entity Reference (XXE)

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog

1,447 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-611page 23 of 29

CVE-2020-2304MEDIUMCVSS 6.5EG 6.5
2020-11-04
Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2020-2298MEDIUMCVSS 6.5EG 6.5
2020-10-08
Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2020-24656MEDIUMCVSS 6.5EG 6.5
2020-08-26
Maltego before 4.2.12 allows XXE attacks.
CVE-2020-24591MEDIUMCVSS 6.5EG 6.5
2020-08-21
The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, …
CVE-2020-8541MEDIUMCVSS 6.5EG 6.5
2020-06-16
OX App Suite through 7.10.3 allows XXE attacks.
CVE-2019-17020MEDIUMCVSS 6.5EG 6.5
2020-01-08
If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would…
CVE-2019-3768MEDIUMCVSS 6.5EG 6.5
2020-01-03
RSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to cause information disclosure of local system files by …
CVE-2019-11216MEDIUMCVSS 6.5EG 6.5
2019-12-04
BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. X…
CVE-2019-10080MEDIUMCVSS 6.5EG 6.5
2019-11-19
The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information su…
CVE-2019-17085MEDIUMCVSS 6.5EG 6.5
2019-11-18
XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. The vulnerability could be exploited to do an XXE attack on Operations Agent.
CVE-2014-3599MEDIUMCVSS 6.5EG 6.5
2019-11-12
HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy
CVE-2019-14276MEDIUMCVSS 6.5EG 6.5
2019-10-23
WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body.
CVE-2019-12711MEDIUMCVSS 6.5EG 6.5
2019-10-02
A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to access sensitive information or…
CVE-2019-15641MEDIUMCVSS 6.5EG 6.5
2019-08-26
xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi.
CVE-2019-1010202MEDIUMCVSS 6.5EG 6.5
2019-07-23
Jeesite 1.2.7 is affected by: XML External Entity (XXE). The impact is: sensitive information disclosure. The component is: convertToModel() function in src/main/java/com.thinkgem.jeesite/modules/act/service/ActProcessService.java. The att…
CVE-2018-17289MEDIUMCVSS 6.5EG 6.5
2019-04-18
An XML external entity (XXE) vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to read arbitrary files via crafted XML inside an imported package configuration (.ZIP…
CVE-2017-18110MEDIUMCVSS 6.5EG 6.5
2019-03-29
The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read files from the filesystem via a XXE vulnerability.
CVE-2019-0277MEDIUMCVSS 6.5EG 6.5
2019-03-12
SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privileges to the SAP space (XML External Entity vulnerability).
CVE-2018-20233MEDIUMCVSS 6.5EG 6.5
2019-01-18
The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML…
CVE-2018-19371MEDIUMCVSS 6.5EG 6.5
2019-01-02
The SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that allows reading sensitive files from the system.
CVE-2018-1000840MEDIUMCVSS 6.5EG 6.5
2018-12-20
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This…
CVE-2018-20298MEDIUMCVSS 6.5EG 6.5
2018-12-19
S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server via the S3 protocol.
CVE-2017-7545MEDIUMCVSS 6.5EG 6.5
2018-07-26
It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application s…
CVE-2018-5433MEDIUMCVSS 6.5EG 6.5
2018-06-13
The TIBCO Administrator server component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains vulnerabilities wherein a malicious user could perform XML extern…
CVE-2018-1000198MEDIUMCVSS 6.5EG 6.5
2018-06-05
A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read permission to make Jenkins process XML eternal entities in an XM…
CVE-2017-15691MEDIUMCVSS 6.5EG 6.5
2018-04-26
In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE…
CVE-2018-10175MEDIUMCVSS 6.5EG 6.5
2018-04-20
Digital Guardian Management Console 7.1.2.0015 has an XXE issue.
CVE-2015-7461MEDIUMCVSS 6.5EG 6.5
2018-03-20
XML external entity (XXE) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote authenticated users to cause a denial of service (memory consumption) via crafted XML data. IBM X-Force ID: 108357.
CVE-2018-5758MEDIUMCVSS 6.5EG 6.5
2018-03-12
The Upload File functionality in upload.jspa in Aurea Jive Jive-n 9.0.2.1 On-Premises allows for an XML External Entity attack through a crafted file, allowing attackers to read arbitrary files.
CVE-2018-3600MEDIUMCVSS 6.5EG 6.5
2018-02-09
A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to disclose sensitive information on vulnerable installations.
CVE-2017-14699MEDIUMCVSS 6.5EG 6.5
2018-01-29
Multiple XML external entity (XXE) vulnerabilities in the AiCloud feature on ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U…
CVE-2016-0219MEDIUMCVSS 6.5EG 6.5
2018-01-16
XML external entity (XXE) vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote authenticated users to cause a denial o…
CVE-2017-15639MEDIUMCVSS 6.5EG 6.5
2017-10-19
tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the "draggable feeds" feature.
CVE-2017-12623MEDIUMCVSS 6.5EG 6.5
2017-10-10
An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. …
CVE-2017-8040MEDIUMCVSS 6.5EG 6.5
2017-09-09
In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Entity) attack was discovered in the Single Sign-On service dashboard. Privileged users can in some cas…
CVE-2015-0194MEDIUMCVSS 6.5EG 6.5
2017-08-02
XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM Sterling File Gateway 2.1 and 2.2 allows remote attackers to read arbitrary files via a crafted XML data.
CVE-2017-11457MEDIUMCVSS 6.5EG 6.5
2017-07-25
XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request, …
CVE-2017-1219MEDIUMCVSS 6.5EG 6.5
2017-07-19
IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force…
CVE-2017-0170MEDIUMCVSS 6.5EG 6.5
2017-07-11
Windows Performance Monitor in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure vul…
CVE-2016-0254MEDIUMCVSS 6.5EG 6.5
2017-06-07
IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote authenticated attacker could exploit this vulnerability to consu…
CVE-2017-2308MEDIUMCVSS 6.5EG 6.5
2017-05-30
An XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to 16.1R1 may allow an authenticated user to read arbitrary files on the device.
CVE-2017-9295MEDIUMCVSS 6.5EG 6.5
2017-05-29
XXE vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Replication Manager before 8.5.2-00 allows authenticated remote users to read arbitrary files.
CVE-2016-4931MEDIUMCVSS 6.5EG 6.5
2017-03-20
XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service.
CVE-2017-3811MEDIUMCVSS 6.5EG 6.5
2017-03-17
An XML External Entity vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to have read access to part of the information stored in the affected system. More Information: CSCvc39165. Known Affected Re…
CVE-2016-3027MEDIUMCVSS 6.5EG 6.5
2017-02-01
IBM Security Access Manager for Web is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive inform…
CVE-2015-7743MEDIUMCVSS 6.5EG 6.5
2017-01-23
XML external entity vulnerability in PRTG Network Monitor before 16.2.23.3077/3078 allows remote authenticated users to read arbitrary files by creating a new HTTP XML/REST Value sensor that accesses a crafted XML file.
CVE-2012-3489MEDIUMCVSS 6.5EG 6.5
2012-10-03
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary…
CVE-2012-0037MEDIUMCVSS 6.5EG 6.5
2012-06-17
Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML exter…
CVE-2011-4107MEDIUMCVSS 6.5EG 6.5
2011-11-17
The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external…
CVE-2021-43990MEDIUMCVSS 6.1EG 6.5
2022-04-20
The affected product is vulnerable to a network-based attack by threat actors supplying a crafted, malicious XML payload designed to trigger an external entity reference call.

Map vulnerabilities like CWE-611 to your infrastructure

EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →