A4:2017 - XML External Entities (XXE)

• OWASP Documentation
• XML External Entity Prevention

Actions by GeneXus

• GeneXus doesn't execute External Entities by default on Web Services.
• If the XMLReader Data Type is used it doesn't excecute External Entities by default.

Actions by Developers

• Check if the XMLReader ReadExternalEntities Property is configured on 1 or true. 
  • Security Scanner helps to detect this scenario with case code #133.