Falhas do tipo CWE-611

698 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2026-15803HIGHIn Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-baseEPSS 0.5%CVE-2024-13971HIGHArbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_proEPSS 0.5%CVE-2025-47778MEDIUMSulu vulnerable to XXE in SVG File upload InspectorEPSS 0.5%CVE-2026-47898MEDIUMApache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParserEPSS 0.5%CVE-2026-114552MEDIUMMailEnable parseObjectResponse XML External Entity Processing Information Disclosure VulnerabilityEPSS 0.5%CVE-2026-91197HIGHFlowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactoryEPSS 0.5%CVE-2026-108357HIGHPhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of ServiceEPSS 0.5%CVE-2026-113582HIGHApache Abdera: XML external entity expansion in Atom document parsingEPSS 0.5%CVE-2026-12666HIGHIBM MQ Java messaging is vulnerable to XML external entity injectionEPSS 0.5%CVE-2025-5877MEDIUMFengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity referenceEPSS 0.5%CVE-2022-0861LOWePO XML extended entity vulnerabilityEPSS 0.5%CVE-2026-76427MEDIUMCisco ISE XML External Entity Injection VulnerabilityEPSS 0.5%CVE-2024-25066MEDIUMRSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a license file, resulting in attacker-controlEPSS 0.5%CVE-2026-18061MEDIUMImproper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePluginEPSS 0.5%CVE-2024-49781HIGHIBM OpenPages XML external entity injectionEPSS 0.5%CVE-2023-6149MEDIUMPossible XXE vulnerability in Jenkins Plugin for Qualys Web Application Security EPSS 0.5%CVE-2026-47960HIGHColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 0.5%CVE-2026-32251CRITICALTolgee has an XXE Injection in Translation ImportEPSS 0.5%CVE-2025-65868CRITICALXML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST requesEPSS 0.5%CVE-2025-10713MEDIUMXML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser ConfigurationEPSS 0.5%