Weaknesses of type CWE-611

648 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2024-31139MEDIUMIn JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detectorEPSS 0.5%CVE-2025-49539MEDIUMColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 0.5%CVE-2023-6836MEDIUMMultiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely usEPSS 0.5%CVE-2025-33121HIGHIBM QRadar SIEM XML external entity injectionEPSS 0.5%CVE-2024-49352HIGHIBM Cognos Anaytics XML external entity injectionEPSS 0.5%CVE-2025-48882HIGHPHPOffice Math allows XXE when processing an XML file in the MathML formatEPSS 0.5%CVE-2021-22501MEDIUMImproper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations Bridge Manager allows Input Data Manipulation.  EPSS 0.5%CVE-2024-3486HIGH XML External Entity injection vulnerability in iManagerEPSS 0.5%CVE-2026-61570HIGHMPXJ: XXE Vulnerability in MerlinReaderEPSS 0.5%CVE-2025-58175MEDIUMGeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity ResolutionEPSS 0.5%CVE-2025-63551HIGHA Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content ManEPSS 0.5%CVE-2024-13971HIGHArbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_proEPSS 0.5%CVE-2026-47898MEDIUMApache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParserEPSS 0.5%CVE-2022-0861LOWePO XML extended entity vulnerabilityEPSS 0.5%CVE-2024-25066MEDIUMRSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a license file, resulting in attacker-controlEPSS 0.5%CVE-2026-47960HIGHColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 0.5%CVE-2024-49781HIGHIBM OpenPages XML external entity injectionEPSS 0.5%CVE-2023-6149MEDIUMPossible XXE vulnerability in Jenkins Plugin for Qualys Web Application Security EPSS 0.5%CVE-2024-4189MEDIUMMultiple XXE sinks in Run LoadRunner script step in OpenText Application Automation ToolsEPSS 0.5%CVE-2024-4184MEDIUMMultiple XXE sinks in ALM archive post-build step in OpenText Application Automation ToolsEPSS 0.5%