CVE-2022-37189

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://docs.python.org/3/library/xml.html#xml-vulnerabilitiesThird Party Advisory
https://github.com/DDMAL/MEI2Volpiano/Product, Third Party Advisory
https://github.com/DDMAL/MEI2Volpiano/blob/987b70fff991235e682405f901388af0f414eaa8/mei2volpiano/mei2volpiano.py#L59Patch, Third Party Advisory
https://pyup.io/vulnerabilities/CVE-2022-37189/50928/Third Party Advisory
https://docs.python.org/3/library/xml.html#xml-vulnerabilitiesThird Party Advisory
https://github.com/DDMAL/MEI2Volpiano/Product, Third Party Advisory
https://github.com/DDMAL/MEI2Volpiano/blob/987b70fff991235e682405f901388af0f414eaa8/mei2volpiano/mei2volpiano.py#L59Patch, Third Party Advisory
https://pyup.io/vulnerabilities/CVE-2022-37189/50928/Third Party Advisory

Timeline

Published: Sep 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-371908.8CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action and function) from "/ap CVE-2022-371916.5The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST requ CVE-2022-371937.4Chipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control. Chipolo devices suffer from a CVE-2022-371977.8IOBit IOTransfer V4 is vulnerable to Unquoted Service Path.CVE-2022-371999.8JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.CVE-2022-37207.2The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which coul CVE-2022-372018.8JFinal CMS 5.1.0 is vulnerable to SQL Injection.CVE-2022-372028.8JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list CVE-2022-372039.8JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its CVE-2022-372049.8Final CMS 5.1.0 is vulnerable to SQL Injection.CVE-2022-372058.8JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its CVE-2022-372078.8JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its