Falhas do tipo CWE-611

698 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2023-50168HIGHPega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation.EPSS 0.4%CVE-2026-19614MEDIUMXML External Entity (XXE) Injection in CyberELF NanoXMLEPSS 0.4%CVE-2023-4218MEDIUMXXE in eclipse.platform / Eclipse IDEEPSS 0.4%CVE-2023-41365MEDIUMInformation Disclosure vulnerability in SAP Business One (B1i)EPSS 0.4%CVE-2017-7907—An Improper XML Parser Configuration issue was discovered in Schneider Electric Wonderware Historian Client 2014 R2 SP1 and prior. An impropEPSS 0.4%CVE-2025-1225MEDIUMywoa WXCallBack Interface XMLParse.java extract xml external entity referenceEPSS 0.4%CVE-2026-70423MEDIUMDell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low EPSS 0.4%CVE-2026-81832HIGHIBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsEPSS 0.4%CVE-2023-52239MEDIUMThe XML parser in Magic xpi Integration Platform 4.13.4 allows XXE attacks, e.g., via onItemImport.EPSS 0.4%CVE-2026-76958HIGHXML External Entity (XXE) Vulnerability in SAP Integration SuiteEPSS 0.4%CVE-2024-2374HIGHXML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of ServiceEPSS 0.4%CVE-2026-76446MEDIUMCisco Identity Services Engine External Entity Injection VulnerabilityEPSS 0.4%CVE-2024-54171HIGHIBM EntireX XML external entity injectionEPSS 0.4%CVE-2025-52888HIGHAllure 2's xunit-xml-plugin Vulnerable to Improper XXE RestrictionEPSS 0.4%CVE-2026-13265MEDIUMIBM MQ Managed File Transfer REST API is vulnerable to XML external entity injectionEPSS 0.4%CVE-2025-2365MEDIUMcrmeb_java WeChatMessageController.java webHook xml external entity referenceEPSS 0.4%CVE-2026-39053MEDIUMOinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic. When attacker-controlled XML is passEPSS 0.4%CVE-2026-13107HIGHMultiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026EPSS 0.4%CVE-2026-13284HIGHIBM MQ Managed File Transfer is vulnerable to XML external entity injectionEPSS 0.4%CVE-2026-13289HIGHIBM MQ Managed File Transfer is vulnerable to XML external entity injectionEPSS 0.4%