    public void testXXEProcessVulnerability() throws Exception {
    	Resource processResource = ResourceFactory.newClassPathResource("xxe-protection/BPMN2-XXE-Process.bpmn2");
    	
    	File dtdFile = new File("src/test/resources/xxe-protection/external.dtd");
    	assertTrue(dtdFile.exists());
    	
    	String dtdContent = IoUtils.readFileAsString(dtdFile);
    	dtdContent = dtdContent.replaceAll("@@PATH@@", dtdFile.getParentFile().getAbsolutePath());
    	
    	IoUtils.write(dtdFile, dtdContent.getBytes("UTF-8"));
    	
    	byte[] data = IoUtils.readBytesFromInputStream(processResource.getInputStream());
    	String processAsString = new String(data, "UTF-8");
    	// replace place holders with actual paths
    	File testFiles = new File("src/test/resources/xxe-protection");
    	
    	assertTrue(testFiles.exists());
    	
    	String path = testFiles.getAbsolutePath();
    	processAsString = processAsString.replaceAll("@@PATH@@", path);
    	
    	Resource resource = ResourceFactory.newReaderResource(new StringReader(processAsString));
    	resource.setSourcePath(processResource.getSourcePath());
    	resource.setTargetPath(processResource.getTargetPath());
    	
        KieBase kbase = createKnowledgeBaseFromResources(resource);
        KieSession ksession = createKnowledgeSession(kbase);
        ProcessInstance processInstance = ksession.startProcess("async-examples.bp1");
        
        String var1 = getProcessVarValue(processInstance, "testScript1");
        String var2 = getProcessVarValue(processInstance, "testScript2");
        
        assertNull(var1);
        assertNull(var2);
        
        assertTrue(processInstance.getState() == ProcessInstance.STATE_COMPLETED);
    }
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.