CWE-611 — Improper Restriction of XML External Entity Reference
CWE-611: Improper Restriction of XML External Entity Reference
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Draft |
| Likelihood of exploit | — |
Description
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Common consequences
- Confidentiality: Read Application Data, Read Files or Directories
- Integrity: Bypass Protection Mechanism
- Availability: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
Mitigations
Implementation — Many XML parsers and validators can be configured to disable external entity expansion.
References
- CWE page: https://cwe.mitre.org/data/definitions/611.html
- CWE list: https://cwe.mitre.org/data/index.html
See all 1,245 pages under Weakness classes (CWE) →
Related pages
Browse by topic
Every page in the corpus, grouped. Search finds one page; this shows what else is here.