Falhas do tipo CWE-611

691 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2026-93570HIGHXML External Entity injection in Szafir and Szafir WeryfikującaEPSS 0.3%CVE-2024-12476HIGHCWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure, impacts workstaEPSS 0.3%CVE-2024-45745MEDIUMTopQuadrant TopBraid EDG JavaScript console XXEEPSS 0.3%CVE-2024-8010LOWXML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary FilesEPSS 0.3%CVE-2022-45386MEDIUMJenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.3%CVE-2026-85970HIGHImproper XML external entity restriction in Progress MarkLogic ServerEPSS 0.3%CVE-2026-66090HIGHXML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File ReadEPSS 0.3%CVE-2026-66089MEDIUMXML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity ExpansionEPSS 0.3%CVE-2026-1218MEDIUMBjskzy Zhiyou ERP com.artery.richclient.RichClientService RichClientService.class initRCForm xml external entity referenceEPSS 0.3%CVE-2026-118039HIGHXML External Entity Reference in Telerik Document Processing Libraries SVG Image ProcessingEPSS 0.3%CVE-2026-41895HIGHchangedetection.io: XXE vulnerability in the changedetection.io projectEPSS 0.3%CVE-2026-92877HIGHThe JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP EPSS 0.3%CVE-2026-12667HIGHIBM MQ .NET client is vulnerable to XML external entity injectionEPSS 0.3%CVE-2026-40882HIGHOpenRemote has XXE in Velbus Asset ImportEPSS 0.3%CVE-2022-41696MEDIUMCVE-2022-41696EPSS 0.3%CVE-2022-43512MEDIUMCVE-2022-43512EPSS 0.3%CVE-2022-45121MEDIUMCVE-2022-45121EPSS 0.3%CVE-2025-52162MEDIUMagorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint. EPSS 0.3%CVE-2023-5136MEDIUMIncorrect Permission Assignment in the TopoGrafix DataPlugin for GPXEPSS 0.3%CVE-2026-4980MEDIUMImproper Restriction of XML External Entity Reference in InkscapeEPSS 0.2%