Weaknesses of type CWE-611

648 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2021-40356—A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter EPSS 1.0%CVE-2018-1077—Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.EPSS 1.0%CVE-2024-28168HIGHApache XML Graphics FOP: XML External Entity (XXE) ProcessingEPSS 1.0%CVE-2022-45397CRITICALJenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attEPSS 1.0%CVE-2022-45396CRITICALJenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 1.0%CVE-2019-10976—Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not saEPSS 1.0%CVE-2022-29801—A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9). The applicEPSS 1.0%CVE-2020-5323MEDIUMDell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an inEPSS 1.0%CVE-2022-40747CRITICAL"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote atEPSS 1.0%CVE-2026-48359CRITICALAdobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 1.0%CVE-2021-41042—In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working EPSS 1.0%CVE-2022-32285—A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compaEPSS 1.0%CVE-2026-34401MEDIUMXML Notepad: XML External Entity (XXE) Injection via Unsafe XmlTextReader in XML Diff and Schema LoadingEPSS 1.0%CVE-2023-27476HIGHXML External Entity (XXE) Injection in OWSLibEPSS 1.0%CVE-2023-2806MEDIUMWeaver e-cology API RequestInfoByXml xml external entity referenceEPSS 1.0%CVE-2020-7036HIGHXXE in Avaya Callback Assist AdministrationEPSS 1.0%CVE-2021-1369MEDIUMCisco Firepower Device Manager On-Box Software XML External Entity VulnerabilityEPSS 1.0%CVE-2024-52596HIGHSimpleSAMLphp xml-common XXE vulnerabilityEPSS 1.0%CVE-2019-3752HIGHDell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.EPSS 1.0%CVE-2024-45294HIGH`org.hl7.fhir.core` XXE vulnerability in XSLT transformsEPSS 1.0%