github - GHSA-p9wf-3xpg-c9g5

GHSA-p9wf-3xpg-c9g5

Vulnerability from github

Published

2021-09-02 17:11

Modified

2024-10-24 21:53

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

XML External Entity Injection in PyWPS

Details

An XML external entity (XXE) injection in PyWPS before 4.5.0 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pywps"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-39371"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611",
      "CWE-91"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-25T19:48:42Z",
    "nvd_published_at": "2021-08-23T01:15:00Z",
    "severity": "HIGH"
  },
  "details": "An XML external entity (XXE) injection in PyWPS before 4.5.0 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.",
  "id": "GHSA-p9wf-3xpg-c9g5",
  "modified": "2024-10-24T21:53:22Z",
  "published": "2021-09-02T17:11:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39371"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geopython/OWSLib/issues/790"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geopython/pywps/pull/616"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geopython/pywps/commit/7d6b26a2e931df2feca0b7fb24f4d01610825aee"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-p9wf-3xpg-c9g5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/geopython/pywps"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pywps/PYSEC-2021-121.yaml"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00001.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "XML External Entity Injection in PyWPS"
}

pysec-2021-121

Vulnerability from pysec

Published

2021-08-23 01:15

Modified

2021-08-23 05:26

Details

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pywps",
        "purl": "pkg:pypi/pywps"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.2.3",
        "3.2.4",
        "3.2.5",
        "3.2.6",
        "4.0.0",
        "4.2.0",
        "4.2.1",
        "4.2.10",
        "4.2.11",
        "4.2.2",
        "4.2.3",
        "4.2.4",
        "4.2.5",
        "4.2.6",
        "4.2.7",
        "4.2.8",
        "4.2.9",
        "4.4.0",
        "4.4.1",
        "4.4.2",
        "4.4.3",
        "4.4.4",
        "4.4.5",
        "trunk"
      ]
    }
  ],
  "aliases": [
    "CVE-2021-39371",
    "GHSA-p9wf-3xpg-c9g5"
  ],
  "details": "An XML external entity (XXE) injection in PyWPS before 4.5.0 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.",
  "id": "PYSEC-2021-121",
  "modified": "2021-08-23T05:26:18.647869Z",
  "published": "2021-08-23T01:15:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/geopython/pywps/pull/616"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/geopython/OWSLib/issues/790"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-p9wf-3xpg-c9g5"
    }
  ]
}

cve-2021-39371

Vulnerability from cvelistv5

Published

2021-08-23 00:03

Modified

2024-08-04 02:06

Severity ?

Summary

An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.

References

▼	URL	Tags
	https://github.com/geopython/pywps/pull/616	x_refsource_MISC
	https://github.com/geopython/OWSLib/issues/790	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/09/msg00001.html	mailing-list, x_refsource_MLIST

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T02:06:42.375Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/geopython/pywps/pull/616"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/geopython/OWSLib/issues/790"
          },
          {
            "name": "[debian-lts-announce] 20210904 [SECURITY] [DLA 2754-1] pywps security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-10T13:16:35",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/geopython/pywps/pull/616"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/geopython/OWSLib/issues/790"
        },
        {
          "name": "[debian-lts-announce] 20210904 [SECURITY] [DLA 2754-1] pywps security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00001.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-39371",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/geopython/pywps/pull/616",
              "refsource": "MISC",
              "url": "https://github.com/geopython/pywps/pull/616"
            },
            {
              "name": "https://github.com/geopython/OWSLib/issues/790",
              "refsource": "MISC",
              "url": "https://github.com/geopython/OWSLib/issues/790"
            },
            {
              "name": "[debian-lts-announce] 20210904 [SECURITY] [DLA 2754-1] pywps security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00001.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-39371",
    "datePublished": "2021-08-23T00:03:20",
    "dateReserved": "2021-08-22T00:00:00",
    "dateUpdated": "2024-08-04T02:06:42.375Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Action not permitted

GHSA-p9wf-3xpg-c9g5

Vulnerability from github

pysec-2021-121

Vulnerability from pysec

cve-2021-39371

Vulnerability from cvelistv5

Tags