Weaknesses of type CWE-611

698 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2024-58335MEDIUMOpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualizEPSS 0.2%CVE-2022-46827LOWIn JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.EPSS 0.2%CVE-2024-9044MEDIUMXML External Entity (XXE) Vulnerability in EasyTaxEPSS 0.2%CVE-2026-82525MEDIUMExterro FTK Imager < 8.3 XXE via Report.xml XSLT ProcessingEPSS 0.2%CVE-2026-57234LOWNokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247EPSS 0.2%CVE-2026-6807MEDIUMNSA GRASSMARLIN Improper Restriction of XML External Entity ReferenceEPSS 0.2%CVE-2024-21796MEDIUMElectronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (DeEPSS 0.2%CVE-2026-102127HIGHKiteworks Email Protection Gateway Improper Restriction of XML External Entity ReferenceEPSS 0.2%CVE-2022-45588HIGHAll versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks. Users EPSS 0.2%CVE-2026-82918MEDIUMXG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation improperEPSS 0.2%CVE-2025-40584MEDIUMA vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5EPSS 0.2%CVE-2025-29932MEDIUMIn JetBrains GoLand before 2025.1 an XXE during debugging was possibleEPSS 0.2%CVE-2024-49704MEDIUMA vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions),EPSS 0.2%CVE-2025-57704MEDIUMEIP Builder XML External Entity Processing Information Disclosure VulnerabilityEPSS 0.2%CVE-2026-57917MEDIUMImproper Restriction of XML External Entity Reference in proCertum SmartSignEPSS 0.2%CVE-2026-22186MEDIUMBio-Formats <= 8.3.0 XXE in Leica XLEF Metadata ParserEPSS 0.2%CVE-2026-16999MEDIUMXXE in Ministry of Justice's UYAP Document EditorEPSS 0.2%CVE-2023-2161MEDIUM A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized read access to the fileEPSS 0.2%CVE-2026-97400MEDIUMjdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)EPSS 0.2%CVE-2026-112198HIGHImproper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop AppEPSS 0.2%