1370
Nature Type ID Name Page
MemberOf 1387 Weaknesses in the 2022 CWE Top 25 Most Dangerous
Software Weaknesses
1387 2597
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Relationship
CWE-918 (SSRF) and CWE-611 (XXE) are closely related, because they both involve webrelated
technologies and can launch outbound requests to unexpected destinations. However,
XXE can be performed client-side, or in other contexts in which the software is not acting directly
as a server, so the "Server" portion of the SSRF acronym does not necessarily apply.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
WASC 43 XML External Entities
Software Fault Patterns SFP24 Tainted input to command
Related Attack Patterns
CAPEC-ID Attack Pattern Name
221 Data Serialization External Entities Blowup
References
[REF-496]OWASP. "XML External Entity (XXE) Processing". < https://www.owasp.org/index.php/
XML_External_Entity_(XXE)_Processing >.
[REF-497]Sascha Herzog. "XML External Entity Attacks (XXE)". 2010 October 0. < https://
owasp.org/www-pdf-archive/XML_Exteral_Entity_Attack.pdf >.2023-04-07.
[REF-498]Gregory Steuck. "XXE (Xml eXternal Entity) Attack". < https://www.beyondsecurity.com/
>.2023-04-07.
[REF-499]WASC. "XML External Entities (XXE) Attack". < http://projects.webappsec.org/w/
page/13247003/XML%20External%20Entities >.
[REF-500]Bryan Sullivan. "XML Denial of Service Attacks and Defenses". 2009 September. <
https://learn.microsoft.com/en-us/archive/msdn-magazine/2009/november/xml-denial-of-serviceattacks-
and-defenses >.2023-04-07.
[REF-501]Chris Cornutt. "Preventing XXE in PHP". < https://websec.io/2012/08/27/Preventing-
XXE-in-PHP.html >.2023-04-07.
CWE-612: Improper Authorization of Index Containing Sensitive Information
Weakness ID : 612
Structure : Simple
Abstraction : Base
Description
The product creates a search index of private or sensitive documents, but it does not properly limit
index access to actors who are authorized to see the original information.
Extended Description
Web sites and other document repositories may apply an indexing routine against a group of
private documents to facilitate search. If the index's results are available to parties who do not have
access to the documents being indexed, then attackers could obtain portions of the documents by
conducting targeted searches and reading the results. The risk is especially dangerous if search
results include surrounding text that was not part of the search query. This issue can appear in
CWE Version 4.14
CWE-613: Insufficient Session Expiration
CWE-613: Insufficient Session Expiration