Falhas do tipo CWE-611

697 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2026-10025HIGHIBM QRadar SIEM has an XML External Entity (XXE) injection vulnerabilityEPSS 0.6%CVE-2020-26229LOWXML External Entity in Dashboard WidgetEPSS 0.6%CVE-2021-32754MEDIUMImproper Restriction of XML External Entity Reference in de.tud.sseEPSS 0.6%CVE-2022-20938MEDIUMA vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could alloEPSS 0.6%CVE-2024-46984HIGHXML External Entity Reference (XXE) vulnerability can lead to a Server Side Request Forgery attack in gematik app-referencevalidatorEPSS 0.6%CVE-2023-6280HIGHXML External Entity Reference on 52North WPSEPSS 0.6%CVE-2024-2826MEDIUMlakernote EasyAdmin saveReportFile xml external entity referenceEPSS 0.6%CVE-2026-108358HIGHPhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of ServiceEPSS 0.6%CVE-2025-11140MEDIUMBjskzy Zhiyou ERP com.artery.richclient.RichClientService openForm xml external entity referenceEPSS 0.6%CVE-2024-29010HIGHThe XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the diEPSS 0.6%CVE-2023-50304HIGHIBM Engineering Requirements Management DOORS XML external entity injectionEPSS 0.6%CVE-2019-18943MEDIUMXML External Entity processingEPSS 0.6%CVE-2024-45048HIGHXML External Entity Reference (XXE) in PHPSpreadsheetEPSS 0.6%CVE-2023-6721HIGHImproper Restriction of XML External Entity Reference in RepoxEPSS 0.6%CVE-2023-32706HIGHDenial Of Service due to Untrusted XML Tag in XML Parser within SAML AuthenticationEPSS 0.6%CVE-2023-28685HIGHJenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.6%CVE-2026-44020HIGHDocling: Unsafe XML Entity Expansion in USPTO Patent BackendEPSS 0.6%CVE-2026-82880HIGHYaCy Search Server through 1.941 XML External Entity Injection via ParsersEPSS 0.6%CVE-2026-90885HIGHApache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was ResolvedEPSS 0.6%CVE-2020-26066MEDIUMCisco SD-WAN vManage Software XML External Entity VulnerabilityEPSS 0.6%