CVE-2021-39371

Опубликовано: 23 авг. 2021

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.

Ссылки

https://github.com/geopython/OWSLib/issues/790
Issue Tracking
Patch
Third Party Advisory
https://github.com/geopython/pywps/pull/616
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/09/msg00001.html
Mailing List
Third Party Advisory
https://github.com/geopython/OWSLib/issues/790
Issue Tracking
Patch
Third Party Advisory
https://github.com/geopython/pywps/pull/616
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/09/msg00001.html
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:osgeo:owslib:0.24.1:*:*:*:*:*:*:*

cpe:2.3:a:osgeo:pywps:*:*:*:*:*:*:*:*

Версия до 4.4.5 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 67%

0.00528

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-611

Связанные уязвимости

CVE-2021-39371

CVSS3: 7.5

ubuntu

больше 4 лет назад

CVE-2021-39371

CVSS3: 7.5

debian

больше 4 лет назад

An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an ...

GHSA-p9wf-3xpg-c9g5

CVSS3: 7.5

github

больше 4 лет назад

XML External Entity Injection in PyWPS

EPSS

Процентиль: 67%

0.00528

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-611