thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

XML External Entity (XXE)

A vulnerability in XML parsers that process external entity references, allowing file disclosure, SSRF or denial of service.

Definition

When DTD processing is enabled, a crafted document can define entities that reference local files or URLs. The primary mitigation is disabling DTDs and external entity resolution in the parser configuration, plus using simpler formats such as JSON where possible and patching XML libraries.

Example

Disabling DOCTYPE declarations in a Java DocumentBuilderFactory configuration to prevent XXE.

Exam tip

XXE is fixed by parser configuration; it was its own Top 10 category in 2017 and is under Security Misconfiguration since 2021.

Related terms