CVE-2020-29128

petl before 1.68, in some configurations, allows resolution of entities in an XML document.

CVSS v3 9.8 CRITICAL
CVSS v2.0 6.8 MEDIUM

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/nvn1729/advisories/blob/master/cve-2020-29128.md	Third Party Advisory
https://github.com/petl-developers/petl/compare/v1.6.7...v1.6.8	Patch Third Party Advisory
https://github.com/petl-developers/petl/issues/526	Issue Tracking Third Party Advisory
https://github.com/petl-developers/petl/pull/527	Patch Third Party Advisory
https://github.com/petl-developers/petl/pull/527/commits/1b0a09f08c3cdfe2e69647bd02f97c1367a5b5f8	Patch Third Party Advisory
https://github.com/petl-developers/petl/security/advisories/GHSA-f5gc-p5m3-v347	Third Party Advisory
https://petl.readthedocs.io/en/stable/changes.html	Release Notes Vendor Advisory
https://github.com/nvn1729/advisories/blob/master/cve-2020-29128.md	Third Party Advisory
https://github.com/petl-developers/petl/compare/v1.6.7...v1.6.8	Patch Third Party Advisory
https://github.com/petl-developers/petl/issues/526	Issue Tracking Third Party Advisory
https://github.com/petl-developers/petl/pull/527	Patch Third Party Advisory
https://github.com/petl-developers/petl/pull/527/commits/1b0a09f08c3cdfe2e69647bd02f97c1367a5b5f8	Patch Third Party Advisory
https://github.com/petl-developers/petl/security/advisories/GHSA-f5gc-p5m3-v347	Third Party Advisory
https://petl.readthedocs.io/en/stable/changes.html	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:petl_project:petl:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:23

Type	Values Removed	Values Added
References	~~() https://github.com/nvn1729/advisories/blob/master/cve-2020-29128.md - Third Party Advisory~~	() https://github.com/nvn1729/advisories/blob/master/cve-2020-29128.md - Third Party Advisory
References	~~() https://github.com/petl-developers/petl/compare/v1.6.7...v1.6.8 - Patch, Third Party Advisory~~	() https://github.com/petl-developers/petl/compare/v1.6.7...v1.6.8 - Patch, Third Party Advisory
References	~~() https://github.com/petl-developers/petl/issues/526 - Issue Tracking, Third Party Advisory~~	() https://github.com/petl-developers/petl/issues/526 - Issue Tracking, Third Party Advisory
References	~~() https://github.com/petl-developers/petl/pull/527 - Patch, Third Party Advisory~~	() https://github.com/petl-developers/petl/pull/527 - Patch, Third Party Advisory
References	~~() https://github.com/petl-developers/petl/pull/527/commits/1b0a09f08c3cdfe2e69647bd02f97c1367a5b5f8 - Patch, Third Party Advisory~~	() https://github.com/petl-developers/petl/pull/527/commits/1b0a09f08c3cdfe2e69647bd02f97c1367a5b5f8 - Patch, Third Party Advisory
References	~~() https://github.com/petl-developers/petl/security/advisories/GHSA-f5gc-p5m3-v347 - Third Party Advisory~~	() https://github.com/petl-developers/petl/security/advisories/GHSA-f5gc-p5m3-v347 - Third Party Advisory
References	~~() https://petl.readthedocs.io/en/stable/changes.html - Release Notes, Vendor Advisory~~	() https://petl.readthedocs.io/en/stable/changes.html - Release Notes, Vendor Advisory

Information

Published : 2020-11-26 05:15

Updated : 2024-11-21 05:23

NVD link : CVE-2020-29128

Mitre link : CVE-2020-29128

CVE.ORG link : CVE-2020-29128

JSON object : View

Products Affected

petl_project

petl

CWE

CWE-91

XML Injection (aka Blind XPath Injection)

9.8 /10