Vulnerabilities > CVE-2021-39371 - XXE vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

osgeo

debian

CWE-611

NVD

Published: 2021-08-23

Updated: 2022-06-02

Summary

An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.

Vulnerable Configurations

Part	Description	Count
Application	Osgeo Osgeo Owslib 0.24.1 Osgeo Pywps 3.0.0 Osgeo Pywps 3.0.1 Osgeo Pywps 3.1.0 Osgeo Pywps 3.2.0 Osgeo Pywps 3.2.1 Osgeo Pywps 3.2.2 Osgeo Pywps 3.2.3 Osgeo Pywps 3.2.4 Osgeo Pywps 3.2.5 Osgeo Pywps 3.2.6 Osgeo Pywps 4.0.0 Osgeo Pywps 4.2.0 Osgeo Pywps 4.2.1 Osgeo Pywps 4.2.2 Osgeo Pywps 4.2.3 Osgeo Pywps 4.2.4 Osgeo Pywps 4.2.5 Osgeo Pywps 4.2.6 Osgeo Pywps 4.2.7 Osgeo Pywps 4.2.8 Osgeo Pywps 4.2.9 Osgeo Pywps 4.2.10 Osgeo Pywps 4.2.11 Osgeo Pywps 4.4.0 Osgeo Pywps 4.4.1 Osgeo Pywps 4.4.2 Osgeo Pywps 4.4.3 Osgeo Pywps 4.4.4	41
OS	Debian Debian Debian Linux 9.0	1

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References