CWE-611
Improper Restriction of XML External Entity Reference
AI Translation Available
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Status
draft
Abstraction
base
Affected Platforms
Not Language-Specific
XML
Not Technology-Specific
Web Based
Technical Details
AI Translation
Common Consequences
confidentiality
integrity
availability
Impacts
read application data
read files or directories
bypass protection mechanism
dos: resource consumption (cpu)
dos: resource consumption (memory)
Detection Methods
automated static analysis
Potential Mitigations
Phases:
implementation
system configuration
Descriptions:
•
Many XML parsers and validators can be configured to disable external entity expansion.