CWE-611 — Improper Restriction of XML External Entity Reference
CWE-611: Improper Restriction of XML External Entity Reference
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Draft |
| Likelihood of exploit | — |
Description
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Common consequences
- Confidentiality: Read Application Data, Read Files or Directories
- Integrity: Bypass Protection Mechanism
- Availability: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
Mitigations
Implementation — Many XML parsers and validators can be configured to disable external entity expansion.
References
- CWE page: https://cwe.mitre.org/data/definitions/611.html
- CWE list: https://cwe.mitre.org/data/index.html