CVE-2022-31471: 
Python vulnerability analysis and mitigation

untangle is a Python library designed to convert XML data to Python objects. A vulnerability identified as CVE-2022-31471 was discovered in untangle versions 1.2.0 and earlier, where the library improperly restricts XML external entity references. The vulnerability was disclosed on July 25, 2022, and affects the core functionality of the library (JVN Report, CVE Details).

The vulnerability stems from improper restriction of XML external entity references (CWE-611). The issue has been assigned a CVSS v3 Base Score of 4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), indicating a moderate severity level. The vulnerability requires user interaction but can be exploited remotely without authentication (JVN Report).

When exploited, this vulnerability allows a remote unauthenticated attacker to read the contents of local files on the system where the vulnerable untangle library is being used. This can lead to unauthorized access to sensitive information stored on the affected server (CVE Details).

The vulnerability has been fixed in untangle version 1.2.1. The fix involves using defusedxml to prevent external entity exploits. Users are strongly advised to upgrade to version 1.2.1 or later to address this security issue (GitHub Release).