CVE-2021-39371: XEE
An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.
Other sources
An XML external entity (XXE) injection in PyWPS before 4.5.0 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pywpsto a version that resolves this vulnerability.Fixed in 4.5.0
Event History
Frequently Asked Questions
What is the vulnerability ID of this XXE injection?
The vulnerability ID for this XML external entity (XXE) injection is CVE-2021-39371.
What is the severity of CVE-2021-39371?
The severity of CVE-2021-39371 is high with a CVSS score of 7.5.
How does the XXE injection in PyWPS before 4.4.5 occur?
The XXE injection in PyWPS before 4.4.5 occurs by assigning a path to the entity, allowing the attacker to view files on the application server filesystem.
Is OWSLib 0.24.1 affected by CVE-2021-39371?
Yes, OWSLib 0.24.1 may also be affected by CVE-2021-39371.
How can I fix the XXE injection vulnerability in PyWPS and OWSLib?
To fix the XXE injection vulnerability, update PyWPS to version 4.4.5 or higher, and OWSLib to a version that has addressed this issue.