Falhas do tipo CWE-611

646 resultados

Injeção de Entidade Externa XML (XXE)

Ocorre quando a aplicação parseia XML sem desabilitar o processamento de entidades externas, permitindo que um atacante injete referências a arquivos locais, servidores internos ou execute ataques de negação de serviço. O risco é crítico: vazamento de dados sensíveis, acesso a sistemas internos ou consumo excessivo de recursos.

Exemplo

Uma API que aceita XML em uma requisição POST parse o conteúdo diretamente com a biblioteca padrão. Um atacante envia um payload como `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` e consegue ler arquivos do servidor.

Como mitigar

Desabilite explicitamente o processamento de entidades externas na configuração do parser XML (ex: `XMLConstants.ACCESS_EXTERNAL_DTD` em Java, `resolve_external_entities = False` em Python). Valide e sanitize entrada XML antes do parse, prefira APIs mais seguras ou formatos como JSON quando possível.

CVE-2022-45395CRITICALJenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 1.1%CVE-2022-45400CRITICALJenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 1.1%CVE-2021-1530MEDIUMCisco BroadWorks Messaging Server XML External Entity Injection VulnerabilityEPSS 1.1%CVE-2024-52800LOWPotential XXE (XML External Entity Injection) vulnerability in veraPDF CLIEPSS 1.1%CVE-2023-51591MEDIUMVoltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure VulnerabilityEPSS 1.1%CVE-2022-32458HIGHData Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) InjectionEPSS 1.1%CVE-2021-21266MEDIUMXXE vulnerability in OpenHABEPSS 1.1%CVE-2021-44477HIGHGE Gas Power ToolBoxST Improper Restriction of XML External Entity ReferenceEPSS 1.1%CVE-2022-21205HIGHImproper restriction of XML external entity reference in DSP Builder Pro for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may aEPSS 1.1%CVE-2019-12711MEDIUMCisco Unified Communications Manager XML External Expansion VulnerabilityEPSS 1.1%CVE-2021-3055MEDIUMPAN-OS: XML External Entity (XXE) Reference Vulnerability in the PAN-OS Web InterfaceEPSS 1.1%CVE-2020-7035HIGHXXE in Avaya Aura Orchestration DesignerEPSS 1.1%CVE-2020-7037HIGHAvaya Equinox Conferencing XXE vulnerabilityEPSS 1.1%CVE-2023-26999CRITICALAn issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a craftedEPSS 1.1%CVE-2018-10614—An XXE vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the application processes specially crafted project XMEPSS 1.1%CVE-2022-22795MEDIUMSigniant - Manager+Agents XML External Entity (XXE)EPSS 1.1%CVE-2019-3768MEDIUMRSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability. A remote authenticated malicious user couEPSS 1.1%CVE-2022-0219MEDIUMImproper Restriction of XML External Entity Reference in skylot/jadxEPSS 1.1%CVE-2023-35892HIGHIBM Financial Transaction Manager for SWIFT Services XML external entity injectionEPSS 1.1%CVE-2020-6590—Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure.EPSS 1.0%