Weaknesses of type CWE-611

648 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2023-46590HIGHA vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions < V2.8). Affected products suffer from a XML exEPSS 0.7%CVE-2024-22354HIGHIBM WebSphere Application Server XML external entity injectionEPSS 0.6%CVE-2025-36049HIGHIBM webMethods Integration Sever XML external entity injectionEPSS 0.6%CVE-2020-26229LOWXML External Entity in Dashboard WidgetEPSS 0.6%CVE-2022-23170MEDIUMSysAid - Okta SSO integrationEPSS 0.6%CVE-2021-32754MEDIUMImproper Restriction of XML External Entity Reference in de.tud.sseEPSS 0.6%CVE-2024-46984HIGHXML External Entity Reference (XXE) vulnerability can lead to a Server Side Request Forgery attack in gematik app-referencevalidatorEPSS 0.6%CVE-2025-3241MEDIUMzhangyanbo2007 youkefu XML Document CallCenterRouterController.java xml external entity referenceEPSS 0.6%CVE-2023-6280HIGHXML External Entity Reference on 52North WPSEPSS 0.6%CVE-2024-2826MEDIUMlakernote EasyAdmin saveReportFile xml external entity referenceEPSS 0.6%CVE-2025-11140MEDIUMBjskzy Zhiyou ERP com.artery.richclient.RichClientService openForm xml external entity referenceEPSS 0.6%CVE-2025-46726HIGHLangroid Vulnerable to XXE Injection via XMLToolMessageEPSS 0.6%CVE-2024-29010HIGHThe XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the diEPSS 0.6%CVE-2023-50304HIGHIBM Engineering Requirements Management DOORS XML external entity injectionEPSS 0.6%CVE-2019-18943MEDIUMXML External Entity processingEPSS 0.6%CVE-2025-49544MEDIUMColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 0.6%CVE-2024-45048HIGHXML External Entity Reference (XXE) in PHPSpreadsheetEPSS 0.6%CVE-2023-6721HIGHImproper Restriction of XML External Entity Reference in RepoxEPSS 0.6%CVE-2023-32706HIGHDenial Of Service due to Untrusted XML Tag in XML Parser within SAML AuthenticationEPSS 0.6%CVE-2023-28685HIGHJenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.6%