CVE-2023-27476CWE-611

XML External Entity (XXE) Injection in OWSLib

High · published March 7, 2023

CVSS v3.1
8.2
EPSS
1%
Percentile
61.8
In the wild
Unconfirmed
What it is

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See `GHSA-8h9c-r582-mggc` for details.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00977 · 61.8th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2023-03-07T23:20Z
EPSS history
Timeline
  • 07 MAR 23:20Z
    XML External Entity (XXE) Injection in OWSLib
    cvelistv5