Vulnerability Details CVE-2022-37189
DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 60.5%
CVSS Severity
CVSS v3 Score 7.5
References
- https://docs.python.org/3/library/xml.html#xml-vulnerabilities
- https://github.com/DDMAL/MEI2Volpiano/
- https://github.com/DDMAL/MEI2Volpiano/blob/987b70fff991235e682405f901388af0f414eaa8/mei2volpiano/mei2volpiano.py#L59
- https://pyup.io/vulnerabilities/CVE-2022-37189/50928/
- https://docs.python.org/3/library/xml.html#xml-vulnerabilities
- https://github.com/DDMAL/MEI2Volpiano/
- https://github.com/DDMAL/MEI2Volpiano/blob/987b70fff991235e682405f901388af0f414eaa8/mei2volpiano/mei2volpiano.py#L59
- https://pyup.io/vulnerabilities/CVE-2022-37189/50928/
Products affected by CVE-2022-37189
-
cpe:2.3:a:ddmal:mei2volpiano:0.0.1
-
cpe:2.3:a:ddmal:mei2volpiano:0.1.0
-
cpe:2.3:a:ddmal:mei2volpiano:0.2.0
-
cpe:2.3:a:ddmal:mei2volpiano:0.5.0
-
cpe:2.3:a:ddmal:mei2volpiano:0.6.0
-
cpe:2.3:a:ddmal:mei2volpiano:0.6.1
-
cpe:2.3:a:ddmal:mei2volpiano:0.7.0
-
cpe:2.3:a:ddmal:mei2volpiano:0.7.1
-
cpe:2.3:a:ddmal:mei2volpiano:0.7.2
-
cpe:2.3:a:ddmal:mei2volpiano:0.7.3
-
cpe:2.3:a:ddmal:mei2volpiano:0.8.2