Falhas do tipo CWE-611

649 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2024-56356MEDIUMIn JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attackEPSS 0.2%CVE-2026-4374HIGHImproper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Recording Service,Routing Service,Queueing Service,Cloud Discovery Service,Observability Collector) allows Serialized Data External Linking, Data Serializat...EPSS 0.2%CVE-2026-33371MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists in the Zimbra ExchangEPSS 0.2%CVE-2024-21765MEDIUMElectronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, ElectronEPSS 0.2%CVE-2026-8045HIGHCWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side fiEPSS 0.2%CVE-2023-42346HIGHAlkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.EPSS 0.2%CVE-2026-19614MEDIUMXML External Entity (XXE) Injection in CyberELF NanoXMLEPSS 0.2%CVE-2026-6501MEDIUMImproper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocument allows Data Serialization External EntEPSS 0.2%CVE-2026-54082MEDIUMveraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFsEPSS 0.2%CVE-2025-4338MEDIUMLantronix Device Installer Improper Restriction of XML External Entity ReferenceEPSS 0.2%CVE-2023-49234MEDIUMAn XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local serverEPSS 0.2%CVE-2023-25955MEDIUMNational land numerical information data conversion tool all versions improperly restricts XML external entity references (XXE). By processiEPSS 0.2%CVE-2024-12298MEDIUMVulnerability Report on Improper Restriction of XML External Entity Reference in NB-DesignerEPSS 0.2%CVE-2026-44445MEDIUMERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI ModuleEPSS 0.2%CVE-2026-76958HIGHXML External Entity (XXE) Vulnerability in SAP Integration SuiteEPSS 0.2%CVE-2026-13265MEDIUMIBM MQ Managed File Transfer REST API is vulnerable to XML external entity injectionEPSS 0.2%CVE-2026-40991MEDIUMXML External Entity (XXE) injection when documenting untrusted XML contentEPSS 0.2%CVE-2020-14379—A flaw was found in Red Hat AMQ Broker in a way that a XEE attack can be done via Broker's configuration files, leading to denial of serviceEPSS 0.2%CVE-2026-33737MEDIUMChamilo LMS has an XML External Entity (XXE) InjectionEPSS 0.2%CVE-2023-26263MEDIUMAll versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the /MIMBWebServiEPSS 0.2%