XML External Entity Injection in PyWPS Affects File System Security

CVE-2021-39371

What is CVE-2021-39371?

An XML external entity (XXE) injection vulnerability exists in PyWPS prior to version 4.4.5. This security flaw allows an unauthorized attacker to exploit the system by manipulating XML input. By crafting a malicious XML payload, the attacker can gain access to sensitive files on the application server's filesystem, potentially exposing confidential information. OWSLib version 0.24.1 may also be susceptible to similar attacks, making it imperative for users to update their software to secure versions.

References