CVE-2022-37189

EUVD-2022-6725
DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
Affected Products (NVD)
VendorProductVersion
ddmalmei2volpiano
𝑥
≤ 0.8.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://docs.python.org/3/library/xml.html#xml-vulnerabilities
https://github.com/DDMAL/MEI2Volpiano/
https://github.com/DDMAL/MEI2Volpiano/blob/987b70fff991235e682405f901388af0f414eaa8/mei2volpiano/mei2volpiano.py#L59
https://pyup.io/vulnerabilities/CVE-2022-37189/50928/
https://docs.python.org/3/library/xml.html#xml-vulnerabilities
https://github.com/DDMAL/MEI2Volpiano/
https://github.com/DDMAL/MEI2Volpiano/blob/987b70fff991235e682405f901388af0f414eaa8/mei2volpiano/mei2volpiano.py#L59
https://pyup.io/vulnerabilities/CVE-2022-37189/50928/