CVE-2018-25082: zwczou WeChat SDK Python to_xml xml external entity reference
First published: Tue Mar 21 2023(Updated: )
A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The name of the patch is e54abadc777715b6dcb545c13214d1dea63df6c9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223403.
Credit: cna@vuldb.com cna@vuldb.com cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/weixin-python | <0.5.5 | 0.5.5 |
| Wechat Sdk Python Project Wechat Sdk Python | <0.5.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://vuldb.com/?id.223403
- https://vuldb.com/?ctiid.223403
- https://github.com/zwczou/weixin-python/pull/30
- https://github.com/zwczou/weixin-python/commit/e54abadc777715b6dcb545c13214d1dea63df6c9
- https://github.com/zwczou/weixin-python/releases/tag/v0.5.5
- https://nvd.nist.gov/vuln/detail/CVE-2018-25082
- https://github.com/advisories/GHSA-h384-ph77-3699 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2018-25082?
The severity of CVE-2018-25082 is critical with a severity value of 9.8.
How does CVE-2018-25082 affect zwczou WeChat SDK Python?
CVE-2018-25082 affects zwczou WeChat SDK Python 0.3.0 by allowing for XML external entity references.
Can CVE-2018-25082 be exploited remotely?
Yes, CVE-2018-25082 can be initiated remotely.
How can I fix CVE-2018-25082?
Upgrading to version 0.5.5 of zwczou WeChat SDK Python or pip/weixin-python can address the vulnerability.
What is the CWE of CVE-2018-25082?
CVE-2018-25082 is associated with CWE-611.
- collector/mitre-cve
- collector/github-advisory-latest
- alias/GHSA-h384-ph77-3699
- alias/CVE-2018-25082
- collector/nvd-index
- collector/github-advisory
- collector/nvd-cve
- agent/title
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- agent/references
- agent/weakness
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- package-manager/pip
- vendor/wechat sdk python project
- canonical/wechat sdk python project wechat sdk python