Weaknesses of type CWE-611

648 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2023-20030MEDIUMCisco Identity Services Engine XML External Entity Injection VulnerabilityEPSS 0.8%CVE-2023-28150MEDIUMAn issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in EPSS 0.7%CVE-2023-28152MEDIUMAn issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD inEPSS 0.7%CVE-2023-27480HIGHData leak through a XAR import XXE attack in xwiki-platform-xar-modelEPSS 0.7%CVE-2025-23195HIGHApache Ambari: XML External Entity (XXE) Vulnerability in Ambari/OozieEPSS 0.7%CVE-2024-47873HIGHPhpSpreadsheet XmlScanner bypass leads to XXEEPSS 0.7%CVE-2020-26064MEDIUMA vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access tEPSS 0.7%CVE-2022-0198MEDIUMImproper Restriction of XML External Entity Reference in stanfordnlp/corenlpEPSS 0.7%CVE-2021-34706MEDIUMCisco Identity Services Engine XML External Entity Injection VulnerabilityEPSS 0.7%CVE-2016-15011MEDIUMe-Contract dssp SignResponseVerifier.java checkSignResponse xml external entity referenceEPSS 0.7%CVE-2019-6194MEDIUMAn XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that coulEPSS 0.7%CVE-2022-4607MEDIUM3D City Database OGC Web Feature Service xml external entity referenceEPSS 0.7%CVE-2024-48917HIGHXXE in PHPSpreadsheet's XLSX readerEPSS 0.7%CVE-2024-28039MEDIUMImproper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated EPSS 0.7%CVE-2023-3276MEDIUMDromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity referenceEPSS 0.7%CVE-2015-10082MEDIUMUIKit0 libplist XML xplist.c plist_from_xml xml external entity referenceEPSS 0.7%CVE-2024-22218HIGHXML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated usersEPSS 0.7%CVE-2023-20174MEDIUMCisco Identity Services Engine XML External Entity Injection VulnerabilitiesEPSS 0.7%CVE-2021-4295MEDIUMONC code-validator-api XML CodeValidatorApiConfiguration.java vocabularyValidationConfigurations xml external entity referenceEPSS 0.7%CVE-2023-28684MEDIUMJenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.7%