CWE-611

Improper Restriction of XML External Entity Reference

Parent: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

1,250 vulnerabilities with CWE-611
CVE-2022-2330 MEDIUM
DLP Endpoint for Windows <11.9.100 - SSRF
CVSS 6.5
CVE-2022-0217 HIGH
prosody < 0.11.12 - XML External Entity Injection via libexpat Library
CVSS 7.5
CVE-2022-22489 CRITICAL
IBM MQ 8.0 and 9.0-9.2 - XML External Entity Information Disclosure
CVSS 9.1
CVE-2022-2838 MEDIUM
Eclipse Sphinx <0.13.1 - Info Disclosure
CVSS 5.3
CVE-2022-2458 HIGH
Red Hat Process Automation Manager < 7.13.1 - XML External Entity Injection in Business Central and Kie-Server APIs
CVSS 8.2
CVE-2022-1704 HIGH
Ignition 7.9.0-7.9.21 - XML External Entity Injection in Backup Restore Functionality
CVSS 7.6
CVE-2022-31775 CRITICAL
IBM DataPower Gateway XML External Entity Injection
CVSS 9.1
CVE-2022-2414 HIGH
Dogtag PKI - XML External Entity File Disclosure via Crafted HTTP Request
CVSS 7.5
CVE-2022-27873 HIGH
Autodesk Fusion 360 < 2.0.12887 - Server-Side Request Forgery via SVG File Parsing
CVSS 7.8
CVE-2022-31471 HIGH
untangle < 1.2.0 - XML External Entity Injection
CVSS 7.5
CVE-2022-2131 HIGH
OpenKM < 6.3.10 - XML External Entity Injection in XMLTextExtractor
CVSS 8.5
CVE-2022-32458 HIGH
Digiwin Business Process Management < 5.8.8.1 - Unauthenticated XML External Entity Injection
CVSS 7.5
CVE-2022-34001 MEDIUM
Unit4 ERP < 7.9 - XML External Entity Injection via ExecuteServerProcessAsynchronously
CVSS 6.5
CVE-2022-22358 HIGH
IBM Sterling Partner Engagement Manager <6.1.2, 6.2, 22.2 - XXE
CVSS 7.1
CVE-2022-35741 CRITICAL
Apache CloudStack >=4.5.0 - XXE Injection
CVSS 9.8
CVE-2022-35168 HIGH
SAP Business One 10.0 - Denial of Service via XML External Entity Injection
CVSS 7.5
CVE-2022-34793 HIGH
Jenkins Recipe Plugin < 1.2 - XML External Entity Injection
CVSS 8.8
CVE-2022-23170 MEDIUM
SysAid Okta SSO 22.1.49-22.1.63 - Unauthenticated XML External Entity Injection via SAMLRequest Parameter
CVSS 5.9
CVE-2022-32285 HIGH
Mendix SAML Module < 1.16.6 - XML External Entity Injection
CVSS 7.5
CVE-2022-31447 HIGH
magicpin 3.4 - XML External Entity Injection via SVG File
CVSS 7.5
CVE-2022-22977 HIGH
VMware Tools 10.0.0-10.3.24 - XML External Entity Injection
CVSS 7.1
CVE-2022-31261 HIGH
Morpheus < 5.2.16 and 5.4.x through 5.4.4 - XML External Entity Injection via SAML Callback
CVSS 7.5
CVE-2022-29801 HIGH
Teamcenter V12.4 < V12.4.0.13 and V13.0 < V13.0.0.9 - XML External Entity Injection
CVSS 7.5
CVE-2022-30971 HIGH
Jenkins Storable Configs Plugin <1.0 - XXE
CVSS 8.8
CVE-2022-22774 HIGH
TIBCO Managed File Transfer Command Center and Internet Server < 8.3.2 - Unauthenticated XML External Entity Injection
CVSS 8.6
Details
Vulnerabilities 1,250
Links
MITRE CWE Entry Search this CWE With Exploits