CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2021-39371
High (7.5). EPSS 1.5% chance of exploitation in the next 30 days. Fixed in pywps 4.5.0.
An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
- CWE
- CWE-611
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- osgeo:owslib
- osgeo:pywps
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p9wf-3xpg-c9g5 | PyPI | pywps | <4.5.0 | 4.5.0 |
| PYSEC-2021-121 | PyPI | pywps | <4.5.0 | 4.5.0 |