Falhas do tipo CWE-611

649 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2026-57234LOWNokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247EPSS 0.2%CVE-2024-21796MEDIUMElectronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (DeEPSS 0.2%CVE-2022-45588HIGHAll versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks. Users EPSS 0.2%CVE-2024-49704MEDIUMA vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions),EPSS 0.2%CVE-2026-23739LOWAsterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE InjectionEPSS 0.2%CVE-2025-57704MEDIUMEIP Builder XML External Entity Processing Information Disclosure VulnerabilityEPSS 0.2%CVE-2026-57917MEDIUMImproper Restriction of XML External Entity Reference in proCertum SmartSignEPSS 0.2%CVE-2025-29932MEDIUMIn JetBrains GoLand before 2025.1 an XXE during debugging was possibleEPSS 0.2%CVE-2026-82918MEDIUMXG VisionTerminal and XG-X VisionTerminal provided by Keyence Corporation improperly restrict XML external entity references. If a user openEPSS 0.2%CVE-2025-40584MEDIUMA vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5EPSS 0.2%CVE-2026-16999MEDIUMXXE in Ministry of Justice's UYAP Document EditorEPSS 0.2%CVE-2023-2161MEDIUM A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized read access to the fileEPSS 0.2%CVE-2026-22186MEDIUMBio-Formats <= 8.3.0 XXE in Leica XLEF Metadata ParserEPSS 0.2%CVE-2026-73235MEDIUMFreeCAD: XXE file read and SSRF via external entity injection in Document.xml SAX parserEPSS 0.2%CVE-2026-44018MEDIUMDocling: Unsafe Archive Extraction and XML Parsing in METS-GBS BackendEPSS 0.2%CVE-2024-54005MEDIUMA vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions),EPSS 0.2%CVE-2026-48981MEDIUMpam_usb: xmlReadFile flags=0 permits XXE network entity fetching in conf.cEPSS 0.2%CVE-2026-75055MEDIUMIn JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXEEPSS 0.2%CVE-2026-75058MEDIUMIn JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importersEPSS 0.2%CVE-2025-4044HIGHXML External Entity Injection vulnerability in various Lexmark Universal DriversEPSS 0.2%