On this page
CWE-611: Improper Restriction of XML External Entity Reference
Weakness Summary
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
- Canonical source: MITRE CWE-611 (opens in a new tab)
- Published Atomicorp CVE observations: 48
- Distinct affected products in those observations: 42
- Active Atomicorp rules associated with this weakness: 42
Atomicorp Research Context
Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.
The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.
A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.
Selected Published CVE Observations
| CVE | Vulnerability | Product | Atomicorp finding | Observed rules |
|---|---|---|---|---|
| CVE-2017-12629 | Apache Solr XML External Entity Injection (CVE-2017-12629) | solr | Protected by Atomicorp rules | 344360 , 344363 , 344370 , 347009 , 380018 , 390722 , 392301 |
| CVE-2018-12463 | Fortify Software Security Center (SSC) 17.x/18.1 - XML External Entity Injection | fortify software security center | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2019-9670 | Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF | zimbra collaboration suite | Protected by Atomicorp rules | 344360 , 344370 , 344372 , 350147 |
| CVE-2022-28219 | ManageEngine ADAudit Plus CVE-2022-28219 | manageengine adaudit plus | Protected by Atomicorp rules | 330791 , 340007 , 340152 , 344360 , 344370 , 347009 , 380018 , 390709 |
| CVE-2022-3980 | Sophos Mobile managed on-premises - XML External Entity Injection | mobile | Protected by Atomicorp rules | 344372 |
| CVE-2024-34102 | CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961) | commerce | Protected by Atomicorp rules | 330791 , 340077 , 340152 , 341256 , 344370 , 344372 , 380018 |
| CVE-2025-2776 | SysAid On-Prem <= 23.3.40 - XML External Entity | sysaid | Protected by Atomicorp rules | 330791 , 340152 , 344372 |
| CVE-2025-2777 | SysAid On-Prem <= 23.3.40 - XML External Entity | sysaid | Protected by Atomicorp rules | 330791 , 340152 , 344372 |
| CVE-2025-58360 | GeoServer WMS GetMap XXE Arbitrary File Read | geoserver | Protected by Atomicorp rules | 330791 , 340152 , 344372 , 391213 |
| CVE-2025-66516 | Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read | tika | Protected by Atomicorp rules | 330791 , 340152 , 344360 , 344372 , 390719 , 391213 |
| CVE-2016-6256 | SAP Business One for Android 1.2.3 - XML External Entity Injection | business one | Protected by Atomicorp rules | 344372 |
| CVE-2018-1821 | IBM Operational Decision Manager 8.x - XML External Entity Injection | operational decision manager | Protected by Atomicorp rules | 330791 , 340152 , 345493 |
| CVE-2020-24589 | WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection | api manager | Protected by Atomicorp rules | 341256 , 344370 , 344372 , 380018 |
| CVE-2021-27931 | LumisXP <10.0.0 - Blind XML External Entity Attack | lumis experience platform | Protected by Atomicorp rules | 344372 , 392301 |
| CVE-2021-37425 | Altova MobileTogether Server 7.3 - XML External Entity Injection (XXE) | mobiletogether server | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2022-31678 | VMWare Cloud Foundation NSX-V - XML External Entity (XXE) | cloud foundation | Protected by Atomicorp rules | 344372 |
| CVE-2016-8526 | Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting | airwave | Protected by Atomicorp rules | 333141 , 341256 , 342259 , 344370 , 344372 , 346755 , 350147 , 350148 , 392301 |
| CVE-2025-11700 | N-able N-Central Authentication Bypass and XXE Scanner | n-central | Protected by Atomicorp rules | 330791 , 340152 , 344372 |
| CVE-2025-54988 | Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read | tika | Protected by Atomicorp rules | 330791 , 340152 , 344360 , 344372 , 390719 , 391213 |
| CVE-2024-22024 | Ivanti Connect Secure - XXE | connect secure | Protected by Atomicorp rules | 380019 |
| CVE-2026-69101 | Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint | tis | Protected by Atomicorp rules | 330791 , 340152 , 344360 , 344370 , 344372 , 344373 , 398008 |
| CVE-2025-68493 | Apache Struts XWork - XML External Entity Injection | struts | Protected by Atomicorp rules | 344370 , 344372 |
| CVE-2026-54640 | OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory | openremote | Protected by Atomicorp rules | 330791 , 340152 , 341256 , 344360 , 344370 , 344372 , 344373 , 380018 |
| CVE-2011-3600 | Apache OFBiz - XML External Entity Injection | ofbiz | Protected by Atomicorp rules | 344372 |
| CVE-2017-17762 | Episerver 7 - Blind XML External Entity Injection | episerver | Protected by Atomicorp rules | 344372 |
| CVE-2018-2392 | SAP Internet Graphics Server (IGS) XMLCHART XXE | internet graphics server | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 344372 , 344373 , 390719 |
| CVE-2018-2393 | SAP Internet Graphics Server (IGS) XMLCHART XXE | internet graphics server | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 344372 , 344373 , 390719 |
| CVE-2019-10266 | Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection | cloud backup suite | Protected by Atomicorp rules | 344372 |
| CVE-2019-13608 | Citrix StoreFront Server - XML External Entity | storefront server | Protected by Atomicorp rules | 344372 , 391213 |
| CVE-2019-8086 | Adobe Experience Manager - XML External Entity Injection | experience manager | Protected by Atomicorp rules | 330925 |
| CVE-2019-9757 | LabKey Server 19.1.0 - XML External Entity (XXE) | labkey server | Protected by Atomicorp rules | 340029 , 341256 , 342259 , 344360 , 344372 , 380018 |
| CVE-2020-11991 | Apache Cocoon 2.1.12 - XML Injection | cocoon | Protected by Atomicorp rules | 344372 |
| CVE-2022-2414 | FreeIPA - XML Entity Injection | dogtagpki | Protected by Atomicorp rules | 344372 |
| CVE-2022-38840 | Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE) | man-eam-0003 | Protected by Atomicorp rules | 344360 , 344370 , 344372 , 380018 |
| CVE-2024-38653 | Ivanti Avalanche SmartDeviceServer - XML External Entity | avalanche | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2024-45293 | TablePress < 2.4.3 - XXE Injection | tablepress | Detected by Atomicorp rules | 377360 |
| CVE-2024-6893 | Journyx - XML External Entities Injection (XXE) | journyx-jtime | Protected by Atomicorp rules | 344360 , 344370 , 344372 |
| CVE-2025-2775 | SysAid On-Prem <= 23.3.40 - XML External Entity | sysaid | Protected by Atomicorp rules | 330791 , 340152 , 344372 |
| CVE-2023-42344 | OpenCMS - XML external entity (XXE) | opencms | Protected by Atomicorp rules | 330791 , 340152 , 344372 |
| CVE-2018-1247 | RSA Authentication Manager 8.2.1.4.0-build1394922 / < 8.3 P1 - XML External Entity Injection / Cross-Site Flashing / DOM Cross-Site Scripting | authentication manager | Protected by Atomicorp rules | 392301 |
| CVE-2017-3548 | Oracle PeopleSoft - 'PeopleSoftServiceListeningConnector' XML External Entity via DOCTYPE | peoplesoft enterprise peopletools | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2025-49493 | Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE) | CloudTest | Protected by Atomicorp rules | 344372 |
| CVE-2019-17554 | Apache Olingo OData 4.0 - XML External Entity Injection | olingo | Protected by Atomicorp rules | 344372 , 345493 |
| CVE-2025-10091 | Jinher OA XML Type xml external entity reference | jinher oa | Protected by Atomicorp rules | 330791 , 340152 , 341256 , 344360 , 344370 , 344372 , 344373 , 347009 , 380018 |
| CVE-2025-10816 | Jinher OA XML text xml external entity reference | jinher oa | Protected by Atomicorp rules | 330791 , 340152 , 344360 , 344370 , 344372 , 344373 , 347009 , 380018 |
| CVE-2018-6225 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | Protected by Atomicorp rules | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344360 , 344370 , 344372 , 346755 , 350147 , 380018 , 390572 , 390585 , 390704 |
| CVE-2025-11035 | Jinher OA text xml external entity reference | jinher oa | Protected by Atomicorp rules | 330791 , 340152 , 344360 , 344370 , 344372 , 344373 , 347009 , 380018 |
| CVE-2025-13209 | bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference | oa git free | Protected by Atomicorp rules | 330791 , 340152 , 344360 , 344370 , 344372 , 344373 , 380018 |
Associated Atomicorp WAF Rules
| Rule | Status | Behavior |
|---|---|---|
| 330791 | Active | disruptive (deny) |
| 330925 | Active | disruptive (deny) |
| 333141 | Active | disruptive (deny) |
| 334168 | Active | disruptive (deny) |
| 337209 | Active | disruptive (deny) |
| 337210 | Active | disruptive (deny) |
| 337211 | Active | disruptive (deny) |
| 340007 | Active | disruptive (deny) |
| 340029 | Active | disruptive (deny) |
| 340077 | Active | disruptive (deny) |
| 340145 | Active | disruptive (deny) |
| 340147 | Active | disruptive (deny) |
| 340148 | Active | disruptive (deny) |
| 340149 | Active | disruptive (deny) |
| 340152 | Active | disruptive (deny) |
| 340156 | Active | disruptive (deny) |
| 341145 | Active | disruptive (deny) |
| 341245 | Active | disruptive (deny) |
| 341256 | Active | disruptive (deny) |
| 342259 | Active | disruptive (deny) |
| 344360 | Active | disruptive (deny) |
| 344363 | Active | disruptive (deny) |
| 344370 | Active | disruptive (deny) |
| 344372 | Active | disruptive (deny) |
| 344373 | Active | disruptive (deny) |
| 345493 | Active | non-disruptive (pass) |
| 346755 | Active | disruptive (deny) |
| 347009 | Active | disruptive (deny) |
| 350147 | Active | disruptive (deny) |
| 350148 | Active | disruptive (deny) |
| 377360 | Active | non-disruptive (pass) |
| 380018 | Active | disruptive (deny) |
| 380019 | Active | disruptive (deny) |
| 390572 | Active | disruptive (deny) |
| 390585 | Active | disruptive (deny) |
| 390704 | Active | disruptive (deny) |
| 390709 | Active | disruptive (deny) |
| 390719 | Active | disruptive (deny) |
| 390722 | Active | disruptive (deny) |
| 391213 | Active | disruptive (deny) |
| 392301 | Active | disruptive (deny) |
| 398008 | Active | non-disruptive (pass) |
Related MITRE CAPEC Context
MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims: