Falhas do tipo CWE-611

687 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2021-1369MEDIUMCisco Firepower Device Manager On-Box Software XML External Entity VulnerabilityEPSS 1.0%CVE-2024-52596HIGHSimpleSAMLphp xml-common XXE vulnerabilityEPSS 1.0%CVE-2019-3752HIGHDell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.EPSS 1.0%CVE-2023-27476HIGHXML External Entity (XXE) Injection in OWSLibEPSS 1.0%CVE-2024-45294HIGH`org.hl7.fhir.core` XXE vulnerability in XSLT transformsEPSS 1.0%CVE-2025-34142MEDIUMETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML HandlerEPSS 1.0%CVE-2023-32327HIGHIBM Security Access Manager Container XML external entity injectionEPSS 1.0%CVE-2022-0221MEDIUMA CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when openiEPSS 1.0%CVE-2021-3902CRITICALImproper Restriction of XML External Entity Reference in dompdf/dompdfEPSS 1.0%CVE-2022-25628HIGHAn authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4EPSS 0.9%CVE-2022-41226CRITICALJenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attaEPSS 0.9%CVE-2023-24187HIGHAn XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to EPSS 0.9%CVE-2024-34345HIGH@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerabilityEPSS 0.9%CVE-2021-3836CRITICALImproper Restriction of XML External Entity Reference in dbeaver/dbeaverEPSS 0.9%CVE-2021-37178—A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). An XML external entity injection vulnerability in the uEPSS 0.9%CVE-2020-28387—A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). When opeEPSS 0.9%CVE-2022-2330MEDIUMXXE vulnerability in DLP Endpoint for WindowsEPSS 0.9%CVE-2024-52007HIGHXXE vulnerability in XSLT parsing in `org.hl7.fhir.core`EPSS 0.9%CVE-2019-25253HIGHKYOCERA Net Admin 3.4.0906 Unauthenticated XML External Entity InjectionEPSS 0.9%CVE-2023-24470CRITICALPotential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0.EPSS 0.9%