Skip to content

CWE-611: XXE

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Also known as Improper Restriction of XML External Entity Reference.

A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.

From the CWE List. © The MITRE Corporation.

Newest

apache poiImproper Restriction of XML External Entity Reference in Apache POICVE-2014-3529Fix availableEPSS 12.8%4.3 MediumSeptember 4, 2014
moodleMoodle Arbitrary File Read via XML External Entity vulnerabilityCVE-2014-3543Fix available4.3 MediumJuly 29, 2014
redhat jboss enterprise application platformXML External Entity Reference in org.picketlink:picketlink-commonCVE-2014-3530Fix available7.5 HighJuly 22, 2014
castor project castor, opensuse +1 moreImproper Restriction of XML External Entity Reference in CastorCVE-2014-3004Public exploitFix available4.3 MediumJune 11, 2014
owncloud server, phpexcel project phpexcel +1 morePHPExcel vulnerable to XXE attacks through libxmlCVE-2014-2054Fix available7.5 HighJune 4, 2014
getid3, owncloud server +1 moregetID3 is vulnerable to XML External Entity (XXE)CVE-2014-2053Fix available7.5 HighJune 4, 2014
makina-corpus soappySOAPpy vulnerable to XML External Entity attacksCVE-2014-32425.0 MediumMay 12, 2014
zend framework, zendopenid +1 moreZendframework Local file disclosure via XXE injection in Zend_XmlRpcCVE-2014-2685Fix available7.5 HighApril 3, 2014
zend framework, zendopenid +1 moreZendframework Local file disclosure via XXE injection in Zend_XmlRpcCVE-2014-2684Fix available6.4 MediumApril 3, 2014
zend framework, zendopenid, zendrest +7 more +9 moreZendframework Local file disclosure via XXE injection in Zend_XmlRpcCVE-2014-2683Fix available5.0 MediumApril 3, 2014
zend framework, zendopenid, zendrest +7 more +9 moreZendframework Local file disclosure via XXE injection in Zend_XmlRpcCVE-2014-2682Fix available6.8 MediumApril 3, 2014
zend framework, zendopenid, zendrest +7 more +9 moreZendframework Local file disclosure via XXE injection in Zend_XmlRpcCVE-2014-2681Fix available6.4 MediumApril 3, 2014
pivotal software spring frameworkCross-Site Request Forgery in Spring FrameworkCVE-2013-6429Fix availableEPSS 90.6%6.8 MediumJanuary 26, 2014
apple ipados, iphone os, macos +7 more +9 moreexpat 2.1.0 and earlier does not properly handle entities expansion unless an application...CVE-2013-0340Fix availableEPSS 19.4%6.8 MediumJanuary 21, 2014
apache solrImproper Restriction of XML External Entity Reference in Apache SolrCVE-2012-6612Fix availableEPSS 10.1%7.5 HighDecember 7, 2013
apache solrApache Solr UpdateRequestHandler for XML resolves XML External EntitiesCVE-2013-6407Fix availableEPSS 11.4%6.4 MediumDecember 7, 2013
trustwave modsecurity, debian linux, fedoraproject fedora +1 more +3 moreModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to...CVE-2013-1915Fix available7.5 HighApril 9, 2013
openstack cinder folsom, folsom, grizzly +3 more +5 moreXML Entity Expansion (XEE) in DjangoCVE-2013-1664Fix available5.0 MediumApril 3, 2013
php, apple mac os x, redhat enterprise linux +2 moreThe SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read...CVE-2013-18244.3 MediumMarch 5, 2013
openstack folsom, keystone essex +1 moreXML External Entity (XXE) in DjangoCVE-2013-1665Fix available5.0 MediumFebruary 27, 2013
zend frameworkZendframework Local file disclosure via XXE injection in Zend_XmlRpcCVE-2012-6532Fix available5.0 MediumFebruary 13, 2013
zend frameworkZendframework Local file disclosure via XXE injection in Zend_XmlRpcCVE-2012-6531Fix available6.4 MediumFebruary 13, 2013
inkscape, canonical ubuntu linux, fedoraproject fedora +1 more +3 moreThe rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files...CVE-2012-5656Fix available5.5 MediumJanuary 18, 2013
zend frameworkZendframework Local file disclosure via XXE injection in Zend_XmlRpcCVE-2012-5657Fix available5.0 MediumJanuary 8, 2013
mahara, debian linux +1 moreMahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files...CVE-2012-22399.1 CriticalNovember 24, 2012
cakefoundation cakephpCakePHPallows remote attackers to read arbitrary files via XML data containing external entity referencesCVE-2012-4399Public exploitFix availableEPSS 12.1%7.5 HighOctober 9, 2012
postgresql, apple mac os x server, canonical ubuntu linux +6 more +8 moreThe xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3...CVE-2012-34896.5 MediumAugust 25, 2012
zend framework, debian linux, fedoraproject fedora +2 moreZendframework Local file disclosure via XXE injection in Zend_XmlRpcCVE-2012-3363Public exploitFix availableEPSS 49.3%9.1 CriticalJune 29, 2012
mark pilgrim feedparserfeedparser denial of service vulnerabilityCVE-2012-2921Fix available5.0 MediumMay 21, 2012
apache openoffice, librdf raptor, libreoffice +10 more +12 moreRedland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice...CVE-2012-0037Fix availableEPSS 13.5%6.5 MediumMarch 22, 2012
xml\ \It was discovered that the XML::Atom Perl module before version 0.39 did not disable external...CVE-2012-1102Fix available7.5 HighMarch 4, 2012
phpmyadmin, debian linux, fedoraproject fedora +2 morephpMyAdmin vulnerable to XML external entity (XXE) injection attackCVE-2011-4107Public exploitFix availableEPSS 12.7%6.5 MediumNovember 17, 2011
splunkThe XML parser in Splunk 4.0.0 through 4.1.4 allows remote authenticated users to obtain...CVE-2010-33228.8 HighSeptember 14, 2010
apple iphone os, safari, canonical ubuntu linux +1 more +3 moreThe XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2...CVE-2009-1699Public exploitEPSS 32.8%7.5 HighJune 10, 2009
adobe acrobat, acrobat reader +1 moreThe Adobe Reader control in Adobe Reader and Acrobat 7.0 and 7.0.1 allows remote attackers to...CVE-2005-1306Public exploitEPSS 14.5%7.5 HighJune 15, 2005