Falhas do tipo CWE-611

683 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2026-77090HIGHCVFS Information DisclosureEPSS 0.3%CVE-2026-21569HIGHThis High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. ThEPSS 0.3%CVE-2026-3511HIGHImproper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticEPSS 0.3%CVE-2026-93891HIGHSecurity Vulnerability identified in IBM TRIRIGA - XXEEPSS 0.3%CVE-2025-46425MEDIUMDell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerabEPSS 0.3%CVE-2026-70448HIGHJenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing IvyEPSS 0.3%CVE-2026-13275HIGHIBM MQ Managed File Transfer is vulnerable to XML external entity injectionEPSS 0.3%CVE-2026-41066HIGHlxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local filesEPSS 0.3%CVE-2026-18172HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.3%CVE-2025-26400MEDIUMSolarWinds Web Help Desk XML External Entity Injection (XXE) VulnerabilityEPSS 0.3%CVE-2025-35112MEDIUMAgiloft XML external entity local path traversalEPSS 0.3%CVE-2023-6194LOWIn Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) rEPSS 0.3%CVE-2025-68463MEDIUMBio.Entrez in Biopython through 186 allows doctype XXE.EPSS 0.3%CVE-2025-13209MEDIUMbestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity referenceEPSS 0.3%CVE-2026-44618MEDIUMApache CXF: XXE vulnerability in WS-Transfer functionalityEPSS 0.3%CVE-2024-3930MEDIUMXML External Entity in AkanaEPSS 0.3%CVE-2026-2074MEDIUMO2OA HTTP POST Request check xml external entity referenceEPSS 0.3%CVE-2026-91858MEDIUMApache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is PresentEPSS 0.3%CVE-2026-56701HIGHGrav - XML External Entity Injection via SVG UploadEPSS 0.3%CVE-2026-54470MEDIUMDell Unisphere for PowerMax, version(s) 10.3.0.5 and prior contain(s) an Improper Restriction of XML External Entity Reference vulnerabilityEPSS 0.3%