Vulnerability · NVD
CVE-2022-48565
CRITICAL 9.8
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
Attack vector : Network
No privileges required
No user interaction
Show raw CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
4.27%
above median
percentile 90.2%
Tracked apps referencing this CVE
For each app: the affected range, the fixing version, and where the tracked app stands today.
Vulnerable CPE configurations (4)
| Vendor | Product | Platform | Versions | CPE 2.3 URI |
|---|---|---|---|---|
| python |
python All platforms (wildcard)
|
All platforms (wildcard) | <3.6.13 | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| python |
python All platforms (wildcard)
|
All platforms (wildcard) | ≥3.7.0 <3.7.10 | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| python |
python All platforms (wildcard)
|
All platforms (wildcard) | ≥3.8.0 <3.8.7 | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| python |
python All platforms (wildcard)
|
All platforms (wildcard) | ≥3.9.0 <3.9.1 | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |