1369
Effectiveness = High
Potential Mitigations
Phase: Implementation
Phase: System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
Observed Examples
Reference Description
CVE-2022-42745 Recruiter software allows reading arbitrary files using XXE
https://www.cve.org/CVERecord?id=CVE-2022-42745
CVE-2005-1306 A browser control can allow remote attackers to determine the existence of
files via Javascript containing XML script.
https://www.cve.org/CVERecord?id=CVE-2005-1306
CVE-2012-5656 XXE during SVG image conversion
https://www.cve.org/CVERecord?id=CVE-2012-5656
CVE-2012-2239 XXE in PHP application allows reading the application's configuration file.
https://www.cve.org/CVERecord?id=CVE-2012-2239
CVE-2012-3489 XXE in database server
https://www.cve.org/CVERecord?id=CVE-2012-3489
CVE-2012-4399 XXE in rapid web application development framework allows reading arbitrary
files.
https://www.cve.org/CVERecord?id=CVE-2012-4399
CVE-2012-3363 XXE via XML-RPC request.
https://www.cve.org/CVERecord?id=CVE-2012-3363
CVE-2012-0037 XXE in office document product using RDF.
https://www.cve.org/CVERecord?id=CVE-2012-0037
CVE-2011-4107 XXE in web-based administration tool for database.
https://www.cve.org/CVERecord?id=CVE-2011-4107
CVE-2010-3322 XXE in product that performs large-scale data analysis.
https://www.cve.org/CVERecord?id=CVE-2010-3322
CVE-2009-1699 XXE in XSL stylesheet functionality in a common library used by some web
browsers.
https://www.cve.org/CVERecord?id=CVE-2009-1699
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1030 OWASP Top Ten 2017 Category A4 - XML External
Entities (XXE)
1026 2437
MemberOf 1200 Weaknesses in the 2019 CWE Top 25 Most Dangerous
Software Errors
1200 2587
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1337 Weaknesses in the 2021 CWE Top 25 Most Dangerous
Software Weaknesses
1337 2589
MemberOf 1340 CISQ Data Protection Measures 1340 2590
MemberOf 1349 OWASP Top Ten 2021 Category A05:2021 - Security
Misconfiguration
1344 2493
MemberOf 1350 Weaknesses in the 2020 CWE Top 25 Most Dangerous
Software Weaknesses
1350 2594
CWE Version 4.14
CWE-612: Improper Authorization of Index Containing Sensitive Information
CWE-612: Improper Authorization of Index Containing Sensitive Information