Falhas do tipo CWE-611

687 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2026-54668HIGHKitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)EPSS 0.3%CVE-2022-41221HIGHThe client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center AdmEPSS 0.3%CVE-2026-2252HIGHXML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)EPSS 0.3%CVE-2026-46722MEDIUMXML External Entity Injection in extension "Faceted Search" (ke_search)EPSS 0.3%CVE-2026-38429CRITICALOpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplieEPSS 0.3%CVE-2026-33913HIGHOpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server FilesEPSS 0.3%CVE-2024-34711CRITICALGeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)EPSS 0.3%CVE-2026-82376HIGHApache Roller: XML external entity processing in trackback response parserEPSS 0.3%CVE-2025-26484MEDIUMDell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability. A high privilegEPSS 0.3%CVE-2026-61741CRITICALhttp4s-scala-xml has an XML External Entity (XXE) processing issueEPSS 0.3%CVE-2026-17646HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.3%CVE-2026-82386HIGHApache Roller: XML external entity processing in OPML bookmark importEPSS 0.3%CVE-2025-58175MEDIUMGeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity ResolutionEPSS 0.3%CVE-2025-22478HIGHDell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerabEPSS 0.3%CVE-2026-28809MEDIUMXXE in esaml SAML library allows local file read and potential SSRFEPSS 0.3%CVE-2025-36589HIGHDell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low prEPSS 0.3%CVE-2024-45745MEDIUMTopQuadrant TopBraid EDG JavaScript console XXEEPSS 0.3%CVE-2026-93030MEDIUMFTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw.EPSS 0.3%CVE-2026-93570HIGHXML External Entity injection in Szafir and Szafir WeryfikującaEPSS 0.3%CVE-2024-12476HIGHCWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure, impacts workstaEPSS 0.3%