Weaknesses of type CWE-611

649 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2020-14379—A flaw was found in Red Hat AMQ Broker in a way that a XEE attack can be done via Broker's configuration files, leading to denial of serviceEPSS 0.2%CVE-2026-18184HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.2%CVE-2023-26263MEDIUMAll versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the /MIMBWebServiEPSS 0.2%CVE-2026-4980MEDIUMImproper Restriction of XML External Entity Reference in InkscapeEPSS 0.2%CVE-2024-39586LOWDell AppSync Server, version 4.3 through 4.6, contains an XML External Entity Injection vulnerability. An adjacent high privileged attacker EPSS 0.2%CVE-2025-52162MEDIUMagorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint. EPSS 0.2%CVE-2020-37192MEDIUMMSN Password Recovery 1.30 - XML External Entity InjectionEPSS 0.2%CVE-2024-22380MEDIUMElectronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) MarEPSS 0.2%CVE-2023-29498MEDIUMImproper restriction of XML external entity reference (XXE) vulnerability exists in FRENIC RHC Loader v1.1.0.3 and earlier. If a user opens EPSS 0.2%CVE-2023-37200MEDIUM A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause loss of confidentiality when replaciEPSS 0.2%CVE-2026-19596MEDIUMOpenNMS XML collector XXE allows arbitrary file read from the OpenNMS hostEPSS 0.2%CVE-2023-22322MEDIUMImproper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier. If a user opeEPSS 0.2%CVE-2023-26264MEDIUMAll versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license parsiEPSS 0.2%CVE-2025-14543HIGHImproper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Core Libraries) allows Serialized Data External Linking.EPSS 0.2%CVE-2026-18172HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.2%CVE-2026-2253HIGHHitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity ReferenceEPSS 0.2%CVE-2022-46827LOWIn JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.EPSS 0.2%CVE-2024-58335MEDIUMOpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualizEPSS 0.2%CVE-2024-9044MEDIUMXML External Entity (XXE) Vulnerability in EasyTaxEPSS 0.2%CVE-2026-82525MEDIUMExterro FTK Imager < 8.3 XXE via Report.xml XSLT ProcessingEPSS 0.2%