On this page
Atomicorp WAF Rule 344372
Rule Summary
- Rule ID: 344372
- Status: Active
- Alert message: XML eXternal Entity: Local / Remote File Inclusion attempt
- Observed CWEs: CWE-74 (1), CWE-78 (1), CWE-79 (4), CWE-89 (4), CWE-91 (1), CWE-112 (1), CWE-200 (4), CWE-295 (2), CWE-306 (1), CWE-352 (1), CWE-399 (1), CWE-610 (4), CWE-611 (38), CWE-787 (1), CWE-918 (1), CWE-1284 (1)
- Revision: 2
- Rule severity: Critical
- Phase: 2 (request body)
- Request surfaces: Request body, JSON request data, SOAP request data
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “XML eXternal Entity: Local / Remote File Inclusion attempt” in the request body, JSON request data, SOAP request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2018-6220 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical |
| CVE-2018-6223 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical |
| CVE-2018-6228 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical |
| CVE-2018-6229 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical |
| CVE-2019-9670 | Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF | zimbra collaboration suite | 9.8 (v3.1) | Critical |
| CVE-2022-3980 | Sophos Mobile managed on-premises - XML External Entity Injection | mobile | 9.8 (v3.1) | Critical |
| CVE-2024-34102 | CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961) | commerce | 9.8 (v3.1) | Critical |
| CVE-2025-2776 | SysAid On-Prem <= 23.3.40 - XML External Entity | sysaid | 9.8 (v3.1) | Critical |
| CVE-2025-2777 | SysAid On-Prem <= 23.3.40 - XML External Entity | sysaid | 9.8 (v3.1) | Critical |
| CVE-2025-58360 | GeoServer WMS GetMap XXE Arbitrary File Read | geoserver | 9.8 (v3.1) | Critical |
| CVE-2025-66516 | Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read | tika | 9.8 (v3.1) | Critical |
| CVE-2016-6256 | SAP Business One for Android 1.2.3 - XML External Entity Injection | business one | 9.6 (v3.0) | Critical |
| CVE-2012-2926 | Atlassian Crowd XML Entity Expansion Remote File Access | bamboo | 9.1 (v3.1) | Critical |
| CVE-2020-24589 | WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection | api manager | 9.1 (v3.1) | Critical |
| CVE-2021-27931 | LumisXP <10.0.0 - Blind XML External Entity Attack | lumis experience platform | 9.1 (v3.1) | Critical |
| CVE-2022-31678 | VMWare Cloud Foundation NSX-V - XML External Entity (XXE) | cloud foundation | 9.1 (v3.1) | Critical |
| CVE-2016-8526 | Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting | airwave | 8.8 (v3.0) | High |
| CVE-2018-6224 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 8.8 (v3.0) | High |
| CVE-2026-41936 | Vvveb < 1.0.8.2 XML External Entity Injection via Import | Vvveb | 8.6 (v4.0) | High |
| CVE-2025-11700 | N-able N-Central Authentication Bypass and XXE Scanner | n-central | 8.4 (v4.0) | High |
| CVE-2025-54988 | Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read | tika | 8.4 (v3.1) | High |
| CVE-2026-69101 | Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint | tis | 8.3 (v4.0) | High |
| CVE-2018-6221 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 8.1 (v3.0) | High |
| CVE-2025-68493 | Apache Struts XWork - XML External Entity Injection | struts | 8.1 (v3.1) | High |
| CVE-2014-0644 | EMC CTA v10.0 Unauthenticated XXE Arbitrary File Read | cloud tiering appliance software | 7.8 (v2.0) | High |
| CVE-2018-6222 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 7.8 (v3.0) | High |
| CVE-2016-3473 | Oracle BI Publisher 11.1.1.6.0/11.1.1.7.0/11.1.1.9.0/12.2.1.0.0 - XML External Entity Injection | business intelligence publisher | 7.7 (v3.0) | High |
| CVE-2026-54640 | OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory | openremote | 7.6 (v3.1) | High |
| CVE-2011-3600 | Apache OFBiz - XML External Entity Injection | ofbiz | 7.5 (v3.1) | High |
| CVE-2013-5014 | Symantec Endpoint Protection Manager /servlet/ConsoleServlet Remote Command Execution | endpoint protection manager | 7.5 (v2.0) | High |
| CVE-2017-17762 | Episerver 7 - Blind XML External Entity Injection | episerver | 7.5 (v3.0) | High |
| CVE-2018-2392 | SAP Internet Graphics Server (IGS) XMLCHART XXE | internet graphics server | 7.5 (v3.0) | High |
| CVE-2018-2393 | SAP Internet Graphics Server (IGS) XMLCHART XXE | internet graphics server | 7.5 (v3.0) | High |
| CVE-2018-8033 | Apache OFBiz - XML External Entity Injection | ofbiz | 7.5 (v3.0) | High |
| CVE-2019-10266 | Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection | cloud backup suite | 7.5 (v3.0) | High |
| CVE-2019-13608 | Citrix StoreFront Server - XML External Entity | storefront server | 7.5 (v3.1) | High |
| CVE-2019-9621 | Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF | zimbra collaboration suite | 7.5 (v3.1) | High |
| CVE-2019-9757 | LabKey Server 19.1.0 - XML External Entity (XXE) | labkey server | 7.5 (v3.1) | High |
| CVE-2020-11991 | Apache Cocoon 2.1.12 - XML Injection | cocoon | 7.5 (v3.1) | High |
| CVE-2022-2414 | FreeIPA - XML Entity Injection | dogtagpki | 7.5 (v3.1) | High |
| CVE-2022-38840 | Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE) | man-eam-0003 | 7.5 (v3.1) | High |
| CVE-2024-6893 | Journyx - XML External Entities Injection (XXE) | journyx-jtime | 7.5 (v3.1) | High |
| CVE-2025-2775 | SysAid On-Prem <= 23.3.40 - XML External Entity | sysaid | 7.5 (v3.1) | High |
| CVE-2023-42344 | OpenCMS - XML external entity (XXE) | opencms | 7.3 (v3.1) | High |
| CVE-2024-2961 | CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961) | glibc | 7.3 (v3.1) | High |
| CVE-2025-9316 | N-able N-Central Authentication Bypass and XXE Scanner | N-central | 6.9 (v4.0) | Medium |
| CVE-2015-5161 | Zend Framework 2.4.2 - PHP FPM XML eXternal Entity Injection | zend framework | 6.8 (v2.0) | Medium |
| CVE-2018-6230 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 6.8 (v3.0) | Medium |
| CVE-2013-5015 | Symantec Endpoint Protection Manager /servlet/ConsoleServlet Remote Command Execution | endpoint protection manager | 6.5 (v2.0) | Medium |
| CVE-2018-6219 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 6.5 (v3.0) | Medium |
| CVE-2016-8527 | Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting | airwave | 6.1 (v3.0) | Medium |
| CVE-2019-10263 | Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection | cloud backup suite | 6.1 (v3.0) | Medium |
| CVE-2025-49493 | Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE) | CloudTest | 5.8 (v3.1) | Medium |
| CVE-2019-17554 | Apache Olingo OData 4.0 - XML External Entity Injection | olingo | 5.5 (v3.1) | Medium |
| CVE-2025-10091 | Jinher OA XML Type xml external entity reference | jinher oa | 5.5 (v4.0) | Medium |
| CVE-2025-10816 | Jinher OA XML text xml external entity reference | jinher oa | 5.5 (v4.0) | Medium |
| CVE-2018-6226 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 5.4 (v3.0) | Medium |
| CVE-2018-6227 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 5.4 (v3.0) | Medium |
| CVE-2026-89247 | WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2014-5266 | Wordpress XMLRPC DoS | WordPress | 5.0 (v2.0) | Medium |
| CVE-2015-0922 | McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure | epolicy orchestrator | 5.0 (v2.0) | Medium |
| CVE-2015-0923 | Ektron 8.5, 8.7, 9.0 XSLT Transform Remote Code Execution | ektron content management system | 5.0 (v2.0) | Medium |
| CVE-2018-6225 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 4.3 (v3.0) | Medium |
| CVE-2015-0921 | McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure | epolicy orchestrator | 4.0 (v2.0) | Medium |
| CVE-2025-11035 | Jinher OA text xml external entity reference | jinher oa | 2.1 (v4.0) | Low |
| CVE-2025-13209 | bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference | oa git free | 2.1 (v4.0) | Low |
| CVE-2015-0975 | OpenNMS Authenticated XXE | - | N/A | N/A |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.