Falhas do tipo CWE-611

646 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2021-41042—In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working EPSS 1.0%CVE-2023-32327HIGHIBM Security Access Manager Container XML external entity injectionEPSS 1.0%CVE-2022-1704HIGHInductive Automation IgnitionEPSS 1.0%CVE-2022-0221MEDIUMA CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when openiEPSS 1.0%CVE-2023-23595HIGHBlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, sEPSS 1.0%CVE-2021-3902CRITICALImproper Restriction of XML External Entity Reference in dompdf/dompdfEPSS 1.0%CVE-2022-43415HIGHJenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.9%CVE-2022-41226CRITICALJenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attaEPSS 0.9%CVE-2023-24187HIGHAn XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to EPSS 0.9%CVE-2024-34345HIGH@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerabilityEPSS 0.9%CVE-2021-37178—A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). An XML external entity injection vulnerability in the uEPSS 0.9%CVE-2025-34142MEDIUMETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML HandlerEPSS 0.9%CVE-2024-52007HIGHXXE vulnerability in XSLT parsing in `org.hl7.fhir.core`EPSS 0.9%CVE-2022-2330MEDIUMXXE vulnerability in DLP Endpoint for WindowsEPSS 0.9%CVE-2022-25628HIGHAn authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4EPSS 0.9%CVE-2019-25253HIGHKYOCERA Net Admin 3.4.0906 Unauthenticated XML External Entity InjectionEPSS 0.9%CVE-2023-24470CRITICALPotential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0.EPSS 0.9%CVE-2021-3836CRITICALImproper Restriction of XML External Entity Reference in dbeaver/dbeaverEPSS 0.9%CVE-2023-23926MEDIUMAPOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.grapEPSS 0.9%CVE-2020-28387—A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). When opeEPSS 0.9%