Weaknesses of type CWE-611

648 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2019-10244—In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator positionEPSS 1.8%CVE-2020-7572—A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.EPSS 1.8%CVE-2022-45468MEDIUMCVE-2022-45468EPSS 1.8%CVE-2026-26171HIGH.NET Denial of Service VulnerabilityEPSS 1.8%CVE-2021-27492—When opening a specially crafted 3DXML file, the application containing Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dReaEPSS 1.7%CVE-2023-36419HIGHAzure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege VulnerabilityEPSS 1.7%CVE-2025-7766HIGHLantronix Provisioning Manager Improper Restriction of XML External Entity ReferenceEPSS 1.7%CVE-2022-34348HIGHIBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remotEPSS 1.7%CVE-2023-38490MEDIUMKirby XML External Entity (XXE) vulnerability in the XML data handlerEPSS 1.7%CVE-2018-17912—An XXE vulnerability exists in CASE Suite Versions 3.10 and prior when processing parameter entities, which may allow remote file disclosureEPSS 1.6%CVE-2020-12025—Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, whEPSS 1.5%CVE-2018-12471MEDIUMExternal Entity processing in the RegistrationSharing moduleEPSS 1.5%CVE-2022-24898MEDIUMArbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xmlEPSS 1.5%CVE-2023-22274HIGHZDI-CAN-21305: Adobe RoboHelp Server UpdateCommandStream XML External Entity Processing Information Disclosure VulnerabilityEPSS 1.5%CVE-2021-21517HIGHSRS Policy Manager 6.X is affected by an XML External Entity Injection (XXE) vulnerability due to a misconfigured XML parser that processes EPSS 1.5%CVE-2021-41098HIGHImproper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRubyEPSS 1.4%CVE-2022-0272HIGHImproper Restriction of XML External Entity Reference in detekt/detektEPSS 1.4%CVE-2023-22832HIGHApache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributesEPSS 1.4%CVE-2012-1102—It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untEPSS 1.4%CVE-2023-40503HIGHLG Simple Editor saveXmlFile XML External Entity Processing Information Disclosure VulnerabilityEPSS 1.4%