Falhas do tipo CWE-611

697 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2019-6194MEDIUMAn XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that coulEPSS 0.7%CVE-2026-89260HIGHMoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback EndpointEPSS 0.7%CVE-2025-34490MEDIUMGFI MailEssentials < 21.8 XXE Arbitrary File ReadEPSS 0.7%CVE-2024-48917HIGHXXE in PHPSpreadsheet's XLSX readerEPSS 0.7%CVE-2024-28039MEDIUMImproper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated EPSS 0.7%CVE-2023-3276MEDIUMDromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity referenceEPSS 0.7%CVE-2024-46602HIGHAn issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. An XML External Entity (XXE) vulnerability may allEPSS 0.7%CVE-2024-46603HIGHAn XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a DeEPSS 0.7%CVE-2015-10082MEDIUMUIKit0 libplist XML xplist.c plist_from_xml xml external entity referenceEPSS 0.7%CVE-2024-22218HIGHXML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated usersEPSS 0.7%CVE-2024-56322LOWGoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionalityEPSS 0.7%CVE-2023-20174MEDIUMCisco Identity Services Engine XML External Entity Injection VulnerabilitiesEPSS 0.7%CVE-2022-43689MEDIUMConcrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure.EPSS 0.7%CVE-2023-28684MEDIUMJenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.7%CVE-2023-45612HIGHIn JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXEEPSS 0.7%CVE-2024-39726HIGHIBM Engineering Insights XML external entity injectionEPSS 0.7%CVE-2021-33950HIGHAn issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function.EPSS 0.7%CVE-2026-85250HIGHApache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource OptionEPSS 0.7%CVE-2026-22016HIGHVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). EPSS 0.7%CVE-2024-4357MEDIUMXML External Entity Processing Information DisclosureEPSS 0.7%