Falhas do tipo CWE-611

698 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2026-16626CRITICALJasperReports Server: XXE Injection Vulnerability (Unauthenticated)EPSS 0.5%CVE-2026-76572MEDIUMpkp pkp-lib XSLTransformer.php _transformPHP xml external entity referenceEPSS 0.5%CVE-2025-6438MEDIUMA CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API callsEPSS 0.5%CVE-2023-30951MEDIUMCVE-2023-30951 EPSS 0.5%CVE-2025-24911MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity ReferenceEPSS 0.4%CVE-2025-54992MEDIUMOpenKilda XXE in SAML configurationEPSS 0.4%CVE-2026-88901HIGHApache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by defaultEPSS 0.4%CVE-2024-39847HIGHArbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAPEPSS 0.4%CVE-2023-37233HIGHLoftware Spectrum before 4.6 HF14 allows authenticated XXE attacks.EPSS 0.4%CVE-2025-14478HIGHDemo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File UploadEPSS 0.4%CVE-2024-47582MEDIUMXML Entity Expansion Vulnerability in SAP NetWeaver AS JAVAEPSS 0.4%CVE-2025-25036MEDIUMJalios JPlatform 10 Authenticated XML External Entity Injection (XXE)EPSS 0.4%CVE-2026-8396HIGHXXE in Netcad's NetGISEPSS 0.4%CVE-2026-79572HIGHAn XXE (XML External Entity) vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive filEPSS 0.4%CVE-2025-47293LOWPowSyBl Core XML Reader allows XXE and SSRFEPSS 0.4%CVE-2026-89212CRITICALXML External Entity in Akana API PlatformEPSS 0.4%CVE-2024-45072MEDIUMIBM WebSphere Application Server XML external entity injectionEPSS 0.4%CVE-2026-12975HIGHApicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dosEPSS 0.4%CVE-2024-45086MEDIUMIBM WebSphere Application Server XML external entity injectionEPSS 0.4%CVE-2026-78224HIGHNextGen Healthcare Mirth Connect Improper Restriction of XML External Entity ReferenceEPSS 0.4%