XML External Entity (XXE) Injection

2021-11-0104:55:53

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

xml external entity injection

easy-xml

parsexml function

__init __.py

sensitive data access

application crash

EPSS

0.002

Percentile

60.9%

JSON

easy-xml is vulnerable to XML external entity injection. When processing XML data, the parseXML function in __init __.py allows an attacker to access sensitive data or crash the application.

References

github.com/darkfoxprime/python-easy_xml/blob/e7359344f6a88c721f563bc8a81bf9a71d4ee0ce/easy_xml/__init__.py#L374

github.com/darkfoxprime/python-easy_xml/issues/1

EPSS

0.002

Percentile

60.9%

JSON

Related for VERACODE:32774