6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2021-23418

GHSA ID

GHSA-r2mj-8wgq-73m6

EPSS Score

0.58812%

CWE

CWE-611

Published

8/9/2021

Updated

9/20/2024

KEV Status

Technology

Python

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2021-23418

CVE-2021-23418: XML External Entity Reference in Glances

The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2021-23418

CVE-2021-23418:

6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2021-23418

GHSA ID

GHSA-r2mj-8wgq-73m6

EPSS Score

0.58812%

CWE

CWE-611

Published

8/9/2021

Updated

9/20/2024

KEV Status

Technology

Python

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Glances	pip	< 3.2.1	3.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from using Python's native XML-RPC implementation without security hardening. The key evidence comes from:

Bandit warning B411 explicitly calling out 'xmlrpclib.Fault' as vulnerable
The fix commits (9d6051b, 85d5a6b) adding defusedxml's monkey_patch() to compat.py
The CWE-611 mapping confirming this is an XML external entity restriction issue
The vulnerability description tying the issue to XML data parsing via Fault While the exact XML processing code isn't shown, the imports of xmlrpclib components in compat.py (before patching) directly enable the vulnerable XML handling flow.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2021-23418: XML External Entity Reference in Glances

CVE-2021-23418:

6.3

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

6.3

6.3

CVE-2021-23418: XML External Entity Reference in Glances

Basic Information

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI