Weaknesses of type CWE-611

648 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2022-46682CRITICALJenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 1.0%CVE-2023-32327HIGHIBM Security Access Manager Container XML external entity injectionEPSS 1.0%CVE-2022-1704HIGHInductive Automation IgnitionEPSS 1.0%CVE-2022-0221MEDIUMA CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when openiEPSS 1.0%CVE-2023-23595HIGHBlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, sEPSS 1.0%CVE-2021-3902CRITICALImproper Restriction of XML External Entity Reference in dompdf/dompdfEPSS 1.0%CVE-2022-43415HIGHJenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.9%CVE-2022-41226CRITICALJenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attaEPSS 0.9%CVE-2023-24187HIGHAn XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to EPSS 0.9%CVE-2024-34345HIGH@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerabilityEPSS 0.9%CVE-2021-37178—A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). An XML external entity injection vulnerability in the uEPSS 0.9%CVE-2025-34142MEDIUMETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML HandlerEPSS 0.9%CVE-2022-2330MEDIUMXXE vulnerability in DLP Endpoint for WindowsEPSS 0.9%CVE-2024-52007HIGHXXE vulnerability in XSLT parsing in `org.hl7.fhir.core`EPSS 0.9%CVE-2022-25628HIGHAn authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4EPSS 0.9%CVE-2019-25253HIGHKYOCERA Net Admin 3.4.0906 Unauthenticated XML External Entity InjectionEPSS 0.9%CVE-2023-24470CRITICALPotential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0.EPSS 0.9%CVE-2021-3836CRITICALImproper Restriction of XML External Entity Reference in dbeaver/dbeaverEPSS 0.9%CVE-2023-23926MEDIUMAPOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.grapEPSS 0.9%CVE-2020-28387—A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). When opeEPSS 0.9%