CVE-2024-37388 ebookmeta XML External Entity vulnerability
Attackers can access sensitive information or cause denial of service via crafted XML input in the lxml library's metadata extraction function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-37388?
CVE-2024-37388 is a critical vulnerability in n/a, published on 7 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.
Weakness: CWE-611
Which versions are affected by CVE-2024-37388?
3 open source packages ship an affected version, including ebookmeta. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ebookmeta PyPI | All versions | 1.2.8 |
ebookmeta PyPI | All versions | 1.2.8 |
ebookmeta PyPI | All versions | 1.2.8 |
Products include Dnkorpushov Ebookmeta.
How do I fix CVE-2024-37388?
Upgrade ebookmeta to 1.2.8 or later.
Is CVE-2024-37388 being exploited?
There is no known exploitation of CVE-2024-37388 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hx54-pf28-7xch, OESA-2024-1749, OESA-2024-1750, OESA-2024-1751, PYSEC-2026-1324.