Falhas do tipo CWE-611

698 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2026-58248MEDIUMXML External Entity Injection in SAP BusinessObjects Business IntelligenceEPSS 0.4%CVE-2025-53621MEDIUMDSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sourcesEPSS 0.4%CVE-2023-4554MEDIUMXML External Entity (XXE) ProcessingEPSS 0.4%CVE-2026-69101HIGHDatavane TIS v5.0.0 XXE Injection via doEditWorkflow EndpointEPSS 0.4%CVE-2025-31497HIGHTEIGarage XML External Entity (XXE) Injection in Document Conversion ServiceEPSS 0.4%CVE-2024-52806HIGHSimpleSAMLphp SAML2 has an XXE in parsing SAML messagesEPSS 0.4%CVE-2018-25142HIGHNovaRad NovaPACS Diagnostics Viewer 8.5 XML External Entity InjectionEPSS 0.4%CVE-2024-28198MEDIUMXML external entity (XXE) injection in OpenOLATEPSS 0.4%CVE-2025-4639HIGHImproper Restriction of XML External Entity Reference in PeergosEPSS 0.4%CVE-2025-10183CRITICALXML External Entity Injection in TecConnect 4.1EPSS 0.4%CVE-2025-24521MEDIUMKeysight Ixia Vision Product Family Improper Restriction of XML External Entity ReferenceEPSS 0.4%CVE-2025-24910MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity ReferenceEPSS 0.4%CVE-2025-11035MEDIUMJinher OA text xml external entity referenceEPSS 0.4%CVE-2025-63917HIGHPDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references. The applicEPSS 0.4%CVE-2025-36374MEDIUMIBM DataPower Gateway affected by XML external entity injectionEPSS 0.4%CVE-2025-30018HIGHMultiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)EPSS 0.4%CVE-2026-18715MEDIUMIBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server LibertyEPSS 0.4%CVE-2024-49535MEDIUMAcrobat Reader | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 0.4%CVE-2024-21048MEDIUMVulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: XML input). Supported versioEPSS 0.4%CVE-2018-0100—A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have EPSS 0.4%