CVE-2021-23418
XML External Entity (XXE) Injection
- State
- Published
- Severity
- 6.3 Medium
- Published
- Jul 29, 2021
- Updated
- Sep 16, 2024
- Reserved
- Jan 8, 2021
Description
The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L | snyk |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Glancesn/a |
|
References
- https://snyk.io/vuln/SNYK-PYTHON-GLANCES-1311807
- https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94
- https://github.com/nicolargo/glances/commit/85d5a6b4af31fcf785d5a61086cbbd166b40b07a
- https://github.com/nicolargo/glances/issues/1025
- https://github.com/nicolargo/glances/commit/9d6051be4a42f692392049fdbfc85d5dfa458b32
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.