Falhas do tipo CWE-611

698 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2025-61813HIGHColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 0.5%CVE-2026-94108HIGHgetID3 through 1.9.26 XML External Entity Injection via XML2arrayEPSS 0.5%CVE-2025-32138MEDIUMWordPress Easy Google Maps plugin <= 1.11.18 - XML External Entity vulnerabilityEPSS 0.5%CVE-2024-1167MEDIUMSEW-EURODRIVE MOVITOOLS MotionStudio Improper Restriction of XML External Entity ReferenceEPSS 0.5%CVE-2025-53689HIGHApache Jackrabbit: XXE vulnerability in jackrabbit-spi-commonsEPSS 0.5%CVE-2025-48006HIGHImproper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and earlier. If a specially crafted request isEPSS 0.5%CVE-2024-37388CRITICALAn XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitiveEPSS 0.5%CVE-2023-24466HIGHPossible XML External Entity Injection in OpenText iManagerEPSS 0.5%CVE-2025-32406HIGHAn XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch EPSS 0.5%CVE-2026-49875MEDIUMApache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtilsEPSS 0.5%CVE-2023-43067MEDIUM Dell Unity prior to 5.3 contains an XML External Entity injection vulnerability. An XXE attack could potentially exploit this vulnerabilityEPSS 0.5%CVE-2025-27136MEDIUMLocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) InjectionEPSS 0.5%CVE-2026-55848HIGHmapfish-print: XXE on MapFish Print allows reading arbitrary files of certain typesEPSS 0.5%CVE-2022-43941HIGHHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference EPSS 0.5%CVE-2025-11341MEDIUMJinher OA type xml external entity referenceEPSS 0.5%CVE-2025-61821MEDIUMColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 0.5%CVE-2023-7307HIGHSangfor Behavior Management System XML External Entity InjectionEPSS 0.5%CVE-2021-42537MEDIUMVISAM VBASE Editor Improper Restriction of XMLEPSS 0.5%CVE-2023-26267MEDIUMphp-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities wEPSS 0.5%CVE-2026-51080CRITICALlibpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability.EPSS 0.5%