PT-2023-11756 · Pyxml · Pyxml

Srikanthprathi · Publicado 2023-06-29 · Atualizado 2023-07-06 · CVE-2020-26709

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions py-xml version 1.0

Description The issue allows attackers to execute arbitrary code via a crafted XML file, exploiting an XML External Entity Injection (XXE) vulnerability.

Recommendations For py-xml version 1.0, consider disabling the XML parsing functionality until a patch is available to prevent exploitation of the XXE vulnerability.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2020-26709

GHSA-J6V2-MWXM-F952

PYSEC-2023-95

Produtos afetados

Pyxml

Referências · 8

• https://github.com/pypa/advisory-database/tree/main/vulns/py-xml/PYSEC-2023-95.yaml · Nota
• https://github.com/PinaeOS/py-xml/issues/2 · Nota
• https://github.com/PinaeOS/py-xml · Nota
• https://osv.dev/vulnerability/PYSEC-2023-95 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2020-26709 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2020-26709 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-j6v2-mwxm-f952 · Aviso do Fabricante
• https://t.me/cibsecurity/65764 · Publicação no Telegram