CyberRota Analysis
AI-GeneratedVersions of the Zeep Python SOAP client prior to 4.3.3 are vulnerable due to improper enforcement of the Settings.forbid_external configuration, which allows for the transitive fetching of external resources via WSDL or XSD documents. This could lead to potential exposure to attacker-controlled URLs, posing a risk of data exfiltration or remote code execution. Organizations using affected versions should prioritize upgrading to 4.3.3 or later to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbid_external is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fixed in version 4.3.3.