Weaknesses of type CWE-611

648 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2022-45395CRITICALJenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 1.1%CVE-2022-45400CRITICALJenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 1.1%CVE-2021-1530MEDIUMCisco BroadWorks Messaging Server XML External Entity Injection VulnerabilityEPSS 1.1%CVE-2023-51591MEDIUMVoltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure VulnerabilityEPSS 1.1%CVE-2024-52800LOWPotential XXE (XML External Entity Injection) vulnerability in veraPDF CLIEPSS 1.1%CVE-2022-32458HIGHData Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) InjectionEPSS 1.1%CVE-2021-21266MEDIUMXXE vulnerability in OpenHABEPSS 1.1%CVE-2021-44477HIGHGE Gas Power ToolBoxST Improper Restriction of XML External Entity ReferenceEPSS 1.1%CVE-2022-21205HIGHImproper restriction of XML external entity reference in DSP Builder Pro for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may aEPSS 1.1%CVE-2019-12711MEDIUMCisco Unified Communications Manager XML External Expansion VulnerabilityEPSS 1.1%CVE-2021-3055MEDIUMPAN-OS: XML External Entity (XXE) Reference Vulnerability in the PAN-OS Web InterfaceEPSS 1.1%CVE-2020-7035HIGHXXE in Avaya Aura Orchestration DesignerEPSS 1.1%CVE-2020-7037HIGHAvaya Equinox Conferencing XXE vulnerabilityEPSS 1.1%CVE-2023-26999CRITICALAn issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a craftedEPSS 1.1%CVE-2018-10614—An XXE vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the application processes specially crafted project XMEPSS 1.1%CVE-2022-22795MEDIUMSigniant - Manager+Agents XML External Entity (XXE)EPSS 1.1%CVE-2019-3768MEDIUMRSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability. A remote authenticated malicious user couEPSS 1.1%CVE-2022-0219MEDIUMImproper Restriction of XML External Entity Reference in skylot/jadxEPSS 1.1%CVE-2023-35892HIGHIBM Financial Transaction Manager for SWIFT Services XML external entity injectionEPSS 1.1%CVE-2020-6590—Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure.EPSS 1.0%