Weaknesses of type CWE-611

649 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2022-41221HIGHThe client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center AdmEPSS 0.3%CVE-2026-38429CRITICALOpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplieEPSS 0.3%CVE-2024-34711CRITICALGeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)EPSS 0.3%CVE-2025-26484MEDIUMDell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability. A high privilegEPSS 0.3%CVE-2026-33913HIGHOpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server FilesEPSS 0.3%CVE-2026-17444MEDIUMIBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsEPSS 0.3%CVE-2026-17443MEDIUMIBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsEPSS 0.3%CVE-2025-13209MEDIUMbestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity referenceEPSS 0.3%CVE-2026-54366HIGHCentreStack < 17.4 XXE via SharePoint Storage ConfigurationEPSS 0.3%CVE-2026-28809MEDIUMXXE in esaml SAML library allows local file read and potential SSRFEPSS 0.3%CVE-2026-58248MEDIUMXML External Entity Injection in SAP BusinessObjects Business IntelligenceEPSS 0.3%CVE-2024-45745MEDIUMTopQuadrant TopBraid EDG JavaScript console XXEEPSS 0.3%CVE-2024-12476HIGHCWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure, impacts workstaEPSS 0.3%CVE-2026-81832HIGHIBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsEPSS 0.3%CVE-2026-70423MEDIUMDell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low EPSS 0.3%CVE-2026-2074MEDIUMO2OA HTTP POST Request check xml external entity referenceEPSS 0.3%CVE-2025-22478HIGHDell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerabEPSS 0.3%CVE-2025-36589HIGHDell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low prEPSS 0.3%CVE-2024-8010LOWXML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary FilesEPSS 0.3%CVE-2026-84941MEDIUMOmada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File ReadEPSS 0.3%