Falhas do tipo CWE-611

648 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2024-2374HIGHXML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of ServiceEPSS 0.4%CVE-2025-27523HIGHXXE vulnerability in JP1/IT Desktop Management 2 - Smart Device ManagerEPSS 0.4%CVE-2024-54171HIGHIBM EntireX XML external entity injectionEPSS 0.4%CVE-2026-56817HIGHNetty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabledEPSS 0.4%CVE-2025-64518HIGHCycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injectionEPSS 0.4%CVE-2026-39053MEDIUMOinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic. When attacker-controlled XML is passEPSS 0.4%CVE-2026-12667HIGHIBM MQ .NET client is vulnerable to XML external entity injectionEPSS 0.4%CVE-2026-13107HIGHMultiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026EPSS 0.4%CVE-2024-5625MEDIUMXML External Entity Injection in PruvaSoft Informatics' Apinizer Management ConsoleEPSS 0.4%CVE-2025-2365MEDIUMcrmeb_java WeChatMessageController.java webHook xml external entity referenceEPSS 0.4%CVE-2026-6653HIGHlibxml2: Use after free in xmlParseInternalSubset via improper entity resolution handlingEPSS 0.4%CVE-2026-57259MEDIUMFoxit PDF Editor/Reader XDP XFA XXE arbitrary local file readEPSS 0.4%CVE-2026-3603HIGHIBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML external entity injection (XXE) attackEPSS 0.4%CVE-2024-20531MEDIUMCisco Identity Services Engine XML External Entity Injection VulnerabilityEPSS 0.4%CVE-2026-40998HIGHJaxp13 XPath XXE via StreamSource and SAXSourceEPSS 0.4%CVE-2026-3404LOWthinkgem JeeSite Endpoint CasOutHandler.java xml external entity referenceEPSS 0.4%CVE-2026-50782HIGHJinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GEPSS 0.3%CVE-2026-10025HIGHIBM QRadar SIEM has an XML External Entity (XXE) injection vulnerabilityEPSS 0.3%CVE-2023-27652MEDIUMAn issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_iEPSS 0.3%CVE-2026-17615HIGHResteasy-core: resteasy sourceprovider remote unauthenticated file readEPSS 0.3%