GitHub Advisoryadvisory · PyPI
GHSA-6xm7-3cc5-47f9 MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)
HIGH
Official page ↗
- Aliases
- CVE-2022-37189
- Ecosystem
- PyPI
- Packages
- mei2volpiano
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-611
- Reviewed
- 2022-09-16
Affected packages
• PyPI mei2volpiano: <= 0.8.2 (no fix yet)
Description
DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input.
Related
Alias · CVE (1)
- CVE-2022-37189 DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. vulnerability
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-37189 advisory
- https://docs.python.org/3/library/xml.html#xml-vulnerabilities web
- https://github.com/DDMAL/MEI2Volpiano web
- https://github.com/DDMAL/MEI2Volpiano/blob/987b70fff991235e682405f901388af0f414eaa8/mei2volpiano/mei2volpiano.py#L59 web
- https://pyup.io/vulnerabilities/CVE-2022-37189/50928 web