id: PYSEC-2024-76
modified: 2024-09-13T21:22:04.531357Z
published: 2024-06-07T19:15:00Z
aliases:
- CVE-2024-36827
- GHSA-whf4-fpj8-pgg8
details: An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata
  function of ebookmeta before v1.2.8 allows attackers to access sensitive information
  or cause a Denial of Service (DoS) via crafted XML input.
affected:
- package:
    ecosystem: PyPI
    name: ebookmeta
    purl: pkg:pypi/ebookmeta
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.2.8
  versions:
  - 0.10.0
  - 0.10.1
  - 0.10.2
  - 0.11.0
  - 0.11.1
  - 0.11.2
  - 0.11.5
  - "0.20"
  - 1.0.0
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - 1.0.5
  - 1.1.0
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.1.4
  - 1.2.0
  - 1.2.1
  - 1.2.2
  - 1.2.3
  - 1.2.4
  - 1.2.5
  - 1.2.6
  - 1.2.7
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
references:
- type: REPORT
  url: https://github.com/dnkorpushov/ebookmeta/issues/16#issue-2317712335
- type: ADVISORY
  url: https://github.com/advisories/GHSA-whf4-fpj8-pgg8