Fallos del tipo CWE-611

646 resultados

Processamento Inseguro de XML Externo (XXE)

Ocorre quando a aplicação processa XML sem desabilitar ou validar entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML resolve essas entidades e expõe dados sensíveis ou permite ataques de negação de serviço.

Ejemplo

Um serviço web que aceita XML de upload processa um arquivo contendo <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>. O parser resolve a entidade e retorna o conteúdo do arquivo no erro ou resposta, ou um atacante injeta billion laughs attack para consumir memória do servidor.

Cómo mitigar

Desabilite explicitamente DTDs e entidades externas no parser XML (em Java, use XMLConstants.ACCESS_EXTERNAL_DTD = ""; em Python, use defusedxml ou desabilite resolve_entities; sempre valide e sanitize entrada XML contra schema predefinido).

CVE-2022-45395CRITICALJenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 1.1%CVE-2022-45400CRITICALJenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 1.1%CVE-2021-1530MEDIUMCisco BroadWorks Messaging Server XML External Entity Injection VulnerabilityEPSS 1.1%CVE-2024-52800LOWPotential XXE (XML External Entity Injection) vulnerability in veraPDF CLIEPSS 1.1%CVE-2023-51591MEDIUMVoltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure VulnerabilityEPSS 1.1%CVE-2022-32458HIGHData Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) InjectionEPSS 1.1%CVE-2021-21266MEDIUMXXE vulnerability in OpenHABEPSS 1.1%CVE-2021-44477HIGHGE Gas Power ToolBoxST Improper Restriction of XML External Entity ReferenceEPSS 1.1%CVE-2022-21205HIGHImproper restriction of XML external entity reference in DSP Builder Pro for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may aEPSS 1.1%CVE-2019-12711MEDIUMCisco Unified Communications Manager XML External Expansion VulnerabilityEPSS 1.1%CVE-2021-3055MEDIUMPAN-OS: XML External Entity (XXE) Reference Vulnerability in the PAN-OS Web InterfaceEPSS 1.1%CVE-2020-7035HIGHXXE in Avaya Aura Orchestration DesignerEPSS 1.1%CVE-2020-7037HIGHAvaya Equinox Conferencing XXE vulnerabilityEPSS 1.1%CVE-2023-26999CRITICALAn issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a craftedEPSS 1.1%CVE-2018-10614—An XXE vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the application processes specially crafted project XMEPSS 1.1%CVE-2022-22795MEDIUMSigniant - Manager+Agents XML External Entity (XXE)EPSS 1.1%CVE-2019-3768MEDIUMRSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability. A remote authenticated malicious user couEPSS 1.1%CVE-2022-0219MEDIUMImproper Restriction of XML External Entity Reference in skylot/jadxEPSS 1.1%CVE-2023-35892HIGHIBM Financial Transaction Manager for SWIFT Services XML external entity injectionEPSS 1.1%CVE-2020-6590—Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure.EPSS 1.0%