Skip to main content

Improper Restriction of XML External Entity Reference

CVE-2025-64518

High
7.5/10

Summary

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. In versions 2.1.0 through 11.0.0, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-611 - Improper Restriction of XML External Entity Reference

Listed 4th in the 'OWASP Top Ten', XML External Entities (XXE) vulnerability allows attackers to provide an XML input that contains an external entity. When the XML is parsed, it can cause data extraction and manipulation, execution of commands, denial-of-service attacks, and server-side request forgery.

References

Advisory Timeline

  • Published