CVE-2022-31471 untangle vulnerable to Improper Restriction of XML External Entity Reference
Remote attackers can read local files via XML external entity injection in the untangle Python library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31471?
CVE-2022-31471 is a high-severity vulnerability in Christian Stefanescu untangle, published on 26 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files.
Weakness: CWE-611
Which versions are affected by CVE-2022-31471?
3 open source packages ship an affected version, including untangle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
untangle PyPI | All versions | 1.2.1 |
untangle PyPI | All versions | 1.2.1 |
untangle PyPI | All versions | 1.2.1 |
Products include Untangle Project Untangle.
How do I fix CVE-2022-31471?
Upgrade untangle to 1.2.1 or later.
Is CVE-2022-31471 being exploited?
There is no known exploitation of CVE-2022-31471 in the wild and no public exploit code.
Other vulnerabilities in Christian Stefanescu untangle
Sources
Also known as DEBIAN-CVE-2022-31471, GHSA-f83q-2cp7-qrjg, PYSEC-2022-244.