PT-2021-22571

CVE-2021-39371

Published

2021-08-23

Updated

2022-06-02

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: PyWPS versions prior to 4.5.0 OWSLib version 0.24.1

Description: An XML external entity (XXE) injection allows an attacker to view files on the application server filesystem by assigning a path to the entity.

Recommendations: For PyWPS versions prior to 4.5.0, update to version 4.5.0 or later to resolve the issue. For OWSLib version 0.24.1, consider disabling the XML external entity parsing functionality as a temporary workaround until a patch is available.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-611: Improper Restriction of XML External Entity Reference

CWE-91: XML Injection (aka Blind XPath Injection)

Related identifiers

CVE-2021-39371

GHSA-P9WF-3XPG-C9G5