Fallos del tipo CWE-611

646 resultados

Processamento Inseguro de XML Externo (XXE)

Ocorre quando a aplicação processa XML sem desabilitar ou validar entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML resolve essas entidades e expõe dados sensíveis ou permite ataques de negação de serviço.

Ejemplo

Um serviço web que aceita XML de upload processa um arquivo contendo <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>. O parser resolve a entidade e retorna o conteúdo do arquivo no erro ou resposta, ou um atacante injeta billion laughs attack para consumir memória do servidor.

Cómo mitigar

Desabilite explicitamente DTDs e entidades externas no parser XML (em Java, use XMLConstants.ACCESS_EXTERNAL_DTD = ""; em Python, use defusedxml ou desabilite resolve_entities; sempre valide e sanitize entrada XML contra schema predefinido).

CVE-2023-46590HIGHA vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions < V2.8). Affected products suffer from a XML exEPSS 0.7%CVE-2024-22354HIGHIBM WebSphere Application Server XML external entity injectionEPSS 0.6%CVE-2025-36049HIGHIBM webMethods Integration Sever XML external entity injectionEPSS 0.6%CVE-2020-26229LOWXML External Entity in Dashboard WidgetEPSS 0.6%CVE-2022-23170MEDIUMSysAid - Okta SSO integrationEPSS 0.6%CVE-2021-32754MEDIUMImproper Restriction of XML External Entity Reference in de.tud.sseEPSS 0.6%CVE-2024-46984HIGHXML External Entity Reference (XXE) vulnerability can lead to a Server Side Request Forgery attack in gematik app-referencevalidatorEPSS 0.6%CVE-2025-3241MEDIUMzhangyanbo2007 youkefu XML Document CallCenterRouterController.java xml external entity referenceEPSS 0.6%CVE-2023-6280HIGHXML External Entity Reference on 52North WPSEPSS 0.6%CVE-2024-2826MEDIUMlakernote EasyAdmin saveReportFile xml external entity referenceEPSS 0.6%CVE-2025-11140MEDIUMBjskzy Zhiyou ERP com.artery.richclient.RichClientService openForm xml external entity referenceEPSS 0.6%CVE-2025-46726HIGHLangroid Vulnerable to XXE Injection via XMLToolMessageEPSS 0.6%CVE-2024-29010HIGHThe XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the diEPSS 0.6%CVE-2023-50304HIGHIBM Engineering Requirements Management DOORS XML external entity injectionEPSS 0.6%CVE-2019-18943MEDIUMXML External Entity processingEPSS 0.6%CVE-2025-49544MEDIUMColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 0.6%CVE-2024-45048HIGHXML External Entity Reference (XXE) in PHPSpreadsheetEPSS 0.6%CVE-2023-6721HIGHImproper Restriction of XML External Entity Reference in RepoxEPSS 0.6%CVE-2023-32706HIGHDenial Of Service due to Untrusted XML Tag in XML Parser within SAML AuthenticationEPSS 0.6%CVE-2023-28685HIGHJenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.6%