Falhas do tipo CWE-611

646 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2025-49493MEDIUMAkamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.EPSS 2.4%CVE-2023-42344HIGHAlkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on EPSS 2.2%CVE-2021-29620HIGHXXE vulnerability on Launch import with externally-defined DTD fileEPSS 2.2%CVE-2021-34436—In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extEPSS 2.2%CVE-2022-39135—Apache Calcite: potential XEE attacksEPSS 2.2%CVE-2018-12544—In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense EPSS 2.2%CVE-2019-1903MEDIUMCisco Security Manager XML Entity Expansion VulnerabilityEPSS 2.2%CVE-2022-1018MEDIUMICSA-22-088-01 Rockwell Automation ISaGRAFEPSS 2.2%CVE-2018-15444MEDIUMCisco Energy Management Suite XML External Entity VulnerabilityEPSS 2.0%CVE-2022-46751HIGHApache Ivy: XML External Entity vulnerability in Apache IvyEPSS 2.0%CVE-2026-23795MEDIUMApache Syncope: Console XXE on Keymaster parametersEPSS 2.0%CVE-2020-2012HIGHPAN-OS: Panorama: XML external entity reference ('XXE') vulnerability leads the to information leakEPSS 1.9%CVE-2017-7464HIGHIt was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE flaws. An attacker coulEPSS 1.9%CVE-2024-55875CRITICALhttp4k has a potential XXE (XML External Entity Injection) vulnerabilityEPSS 1.9%CVE-2022-40705HIGHApache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTPEPSS 1.9%CVE-2024-51132CRITICALAn XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary EPSS 1.9%CVE-2021-3878CRITICALImproper Restriction of XML External Entity Reference in stanfordnlp/corenlpEPSS 1.9%CVE-2022-21949HIGHMultiple XXE vulnerabilities in OBSEPSS 1.9%CVE-2018-0108—A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band EPSS 1.8%CVE-2018-0414—Cisco Secure Access Control Server XML External Entity Injection VulnerabilityEPSS 1.8%