Fallos del tipo CWE-611

698 resultados

Processamento Inseguro de XML Externo (XXE)

Ocorre quando a aplicação processa XML sem desabilitar ou validar entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML resolve essas entidades e expõe dados sensíveis ou permite ataques de negação de serviço.

Ejemplo

Um serviço web que aceita XML de upload processa um arquivo contendo <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>. O parser resolve a entidade e retorna o conteúdo do arquivo no erro ou resposta, ou um atacante injeta billion laughs attack para consumir memória do servidor.

Cómo mitigar

Desabilite explicitamente DTDs e entidades externas no parser XML (em Java, use XMLConstants.ACCESS_EXTERNAL_DTD = ""; em Python, use defusedxml ou desabilite resolve_entities; sempre valide e sanitize entrada XML contra schema predefinido).

CVE-2023-28681HIGHJenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.6%CVE-2025-10816MEDIUMJinher OA XML text xml external entity referenceEPSS 0.6%CVE-2026-24400HIGHAssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertionEPSS 0.6%CVE-2022-4818MEDIUMTalend Open Studio for MDM SystemStorageWrapper.java xml external entity referenceEPSS 0.6%CVE-2024-46455CRITICALunstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.EPSS 0.6%CVE-2024-25971MEDIUMDell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. A remote high privileged attacker coEPSS 0.6%CVE-2022-2838—In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allEPSS 0.6%CVE-2021-47621HIGHClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.EPSS 0.6%CVE-2025-4641CRITICALXML External Entity (XXE) injection vulnerability in WebDriverManagerEPSS 0.6%CVE-2024-55887HIGHUcum-java has an XXE vulnerability in XML parsingEPSS 0.6%CVE-2026-54079HIGHveraPDF Validation XXE via XFAEPSS 0.6%CVE-2026-54078HIGHveraPDF Validation XXE via Rich TextEPSS 0.6%CVE-2025-31039CRITICALWordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerabilityEPSS 0.6%CVE-2022-50899HIGHGeonetwork 4.2.0 - XML External Entity (XXE)EPSS 0.6%CVE-2024-50442MEDIUMWordPress Royal Elementor Addons and Templates plugin <= 1.3.980 - XML External Entity (XXE) vulnerabilityEPSS 0.5%CVE-2022-39954MEDIUMAn improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.EPSS 0.5%CVE-2024-51445HIGHA vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The affected application contEPSS 0.5%CVE-2023-6147MEDIUMPossible XXE vulnerability in Jenkins Plugin for Qualys Policy ComplianceEPSS 0.5%CVE-2023-0871MEDIUMAn XML External Entity injection vulnerabilityEPSS 0.5%CVE-2016-15026MEDIUM3breadt dd-plist xml external entity referenceEPSS 0.5%