CVE-2024-36827 ebookmeta XML External Entity vulnerability
Attackers can exploit an XML External Entity vulnerability in the ebookmeta library to access sensitive information or cause a Denial of Service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-36827?
CVE-2024-36827 is a high-severity vulnerability in n/a, published on 7 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.
Weakness: CWE-611
Which versions are affected by CVE-2024-36827?
3 open source packages ship an affected version, including ebookmeta. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ebookmeta PyPI | All versions | 1.2.8 |
ebookmeta PyPI | All versions | 1.2.8 |
ebookmeta PyPI | All versions | 1.2.8 |
Products include Dnkorpushov Ebookmeta.
How do I fix CVE-2024-36827?
Upgrade ebookmeta to 1.2.8 or later.
Is CVE-2024-36827 being exploited?
There is no known exploitation of CVE-2024-36827 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-whf4-fpj8-pgg8, PYSEC-2024-76.