Falhas do tipo CWE-611

646 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2025-8355HIGHXXE leading to SSRFEPSS 8.2%CVE-2018-20843HIGHIn libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a hEPSS 7.1%CVE-2023-20052MEDIUMOn Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClEPSS 7.0%CVE-2026-20029MEDIUMCisco Identity Services Engine XML External Entity Processing Information Disclosure VulnerabilityEPSS 6.1%CVE-2021-23901—An XML external entity (XXE) injection vulnerability exists in the Nutch DmozParserEPSS 4.4%CVE-2020-1693HIGHA flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unautheEPSS 4.3%CVE-2022-46300MEDIUMCVE-2022-46300EPSS 4.1%CVE-2019-3773—Spring Web Services XML External Entity Injection (XXE)EPSS 4.1%CVE-2018-4942HIGHAdobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Unsafe XML External Entity EPSS 4.0%CVE-2023-46265MEDIUMAn unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF).EPSS 4.0%CVE-2021-40439—Billion LaughsEPSS 3.9%CVE-2022-40771MEDIUMZoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information DiscloEPSS 3.6%CVE-2023-45727HIGHProself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1EPSS 3.5%KEVCVE-2020-8256—A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file readiEPSS 3.4%CVE-2022-45876MEDIUMCVE-2022-45876EPSS 3.3%CVE-2021-40722CRITICALAEM Forms Improper Restriction of XML External Entity ReferenceEPSS 3.3%CVE-2023-28340MEDIUMZoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack.EPSS 3.2%CVE-2023-22624HIGHZoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks.EPSS 3.2%CVE-2019-1698MEDIUMCisco IoT Field Network Director XML External Entity VulnerabilityEPSS 3.1%CVE-2017-3206—The Action Message Format (AMF3) deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messagesEPSS 3.1%