Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS01MndyLTN2d3ctcm1wcc4AAejn
SOAPpy vulnerable to XML External Entity attacks
SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Permalink: https://github.com/advisories/GHSA-52wr-3vww-rmpqJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01MndyLTN2d3ctcm1wcc4AAejn
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: over 1 year ago
EPSS Percentage: 0.00352
EPSS Percentile: 0.72524
Identifiers: GHSA-52wr-3vww-rmpq, CVE-2014-3242
References:
- https://nvd.nist.gov/vuln/detail/CVE-2014-3242
- http://seclists.org/fulldisclosure/2014/May/20
- http://www.openwall.com/lists/oss-security/2014/05/06/1
- http://www.openwall.com/lists/oss-security/2014/05/06/9
- https://web.archive.org/web/20150501220613/http://www.pnigos.com/?p=260
- https://web.archive.org/web/20200229062311/http://www.securityfocus.com/bid/67216
- https://github.com/advisories/GHSA-52wr-3vww-rmpq
Affected Packages
pypi:SOAPpy
Dependent packages: 2Dependent repositories: 143
Downloads: 7,562 last month
Affected Version Ranges: <= 0.12.5
No known fixed version
All affected versions: 0.12.1, 0.12.3, 0.12.4, 0.12.5