Falhas do tipo CWE-611

647 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2025-7823MEDIUMJinher OA ProjectScheduleDelete.aspx xml external entity referenceEPSS 0.5%CVE-2024-36827HIGHAn XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensEPSS 0.5%CVE-2025-7824MEDIUMJinher OA XmlHttp.aspx xml external entity referenceEPSS 0.5%CVE-2024-40075MEDIUMLaravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.EPSS 0.5%CVE-2024-3969HIGH XML External Entity injection vulnerability in iManagerEPSS 0.5%CVE-2023-3113HIGHAn unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could resulEPSS 0.5%CVE-2024-25606HIGHXXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before uEPSS 0.5%CVE-2026-12752HIGHMultiple security vulnerabilities addressed with IBM Business Automation Workflow August 2026EPSS 0.5%CVE-2026-12756HIGHMultiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026EPSS 0.5%CVE-2026-40682CRITICALApache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistorEPSS 0.5%CVE-2025-0162HIGHIBM Aspera Shares XML external entity injectionEPSS 0.5%CVE-2025-61823MEDIUMColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 0.5%CVE-2022-3338MEDIUMXXE in Trellix ePO serverEPSS 0.5%CVE-2025-53689HIGHApache Jackrabbit: XXE vulnerability in jackrabbit-spi-commonsEPSS 0.5%CVE-2024-7098CRITICALXML Injection in SFS Consulting's ww.WinsureEPSS 0.5%CVE-2024-10218CRITICALTIBCO Hawk Stored-XEE VulnerabilityEPSS 0.5%CVE-2025-36608MEDIUMDell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of XML External Entity Reference vulnerability.EPSS 0.5%CVE-2023-41369LOWExternal Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)EPSS 0.5%CVE-2023-26058MEDIUMAn XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a propeEPSS 0.5%CVE-2023-26057MEDIUMAn XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and aEPSS 0.5%