{"action":"Upgrade pywps to 4.5.0 or later.","affected":[{"fixed":"4.5.0","introduced":"0"}],"component":"pywps","cve_ids":["CVE-2021-39371"],"ecosystem":"PyPI","epss":0.01524,"exploited":false,"fixed_versions":["4.5.0"],"ghsa_id":"GHSA-p9wf-3xpg-c9g5","id":"tcs_01M5KGB4ZV808XJD1EXTTBJRJQ","modified_at":"2023-11-08T04:06:35.706904Z","published_at":"2021-08-23T01:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-121","https://github.com/geopython/pywps/pull/616","https://github.com/geopython/OWSLib/issues/790","https://github.com/advisories/GHSA-p9wf-3xpg-c9g5"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-121","url":"https://osv.dev/vulnerability/PYSEC-2021-121"}],"summary":"An XML external entity (XXE) injection in PyWPS before 4.5.0 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected"}