Weaknesses of type CWE-611

648 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2023-40506HIGHLG Simple Editor copyContent XML External Entity Processing Information Disclosure VulnerabilityEPSS 1.4%CVE-2023-40503HIGHLG Simple Editor saveXmlFile XML External Entity Processing Information Disclosure VulnerabilityEPSS 1.4%CVE-2018-17247—Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing exteEPSS 1.4%CVE-2023-25926MEDIUMIBM Security Guardium Key Lifecycle Manager XML external entity injectionEPSS 1.4%CVE-2022-22486CRITICALIBM Tivoli Workload Scheduler XML external entity injectionEPSS 1.4%CVE-2021-3869HIGHImproper Restriction of XML External Entity Reference in stanfordnlp/corenlpEPSS 1.4%CVE-2023-27874CRITICALIBM Aspera Faspex XML external entity injectionEPSS 1.3%CVE-2020-15232CRITICALXML External Entity attack in mapfish-printEPSS 1.3%CVE-2023-39472MEDIUMInductive Automation Ignition SimpleXMLReader XML External Entity Processing Information Disclosure VulnerabilityEPSS 1.3%CVE-2023-24429CRITICALJenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no EPSS 1.3%CVE-2019-15983MEDIUMCisco Data Center Network Manager XML External Entity Read Access VulnerabilityEPSS 1.3%CVE-2021-40500—SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missEPSS 1.3%CVE-2023-49733—Apache Cocoon's StreamGenerator is vulnerable to XXE injectionEPSS 1.3%CVE-2025-2905CRITICALAn XML External Entity (XXE) vulnerability in Multiple WSO2 ProductsEPSS 1.3%CVE-2020-9044HIGHMetasys Improper Restriction of XML External Entity ReferenceEPSS 1.3%CVE-2022-38389HIGHIBM Tivoli Workload Scheduler XML external entity injectionEPSS 1.3%CVE-2020-3405MEDIUMCisco SD-WAN vManage Software XML External Entity VulnerabilityEPSS 1.3%CVE-2023-24430CRITICALJenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 1.3%CVE-2022-23640CRITICALImproper Restriction of XML External Entity Reference in Excel-Streaming-ReaderEPSS 1.3%CVE-2021-22140—Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawleEPSS 1.3%