The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data.
CVE-2024-3572 - High Severity Vulnerability
A high-level Web Crawling and Web Scraping framework
Library home page: https://files.pythonhosted.org/packages/29/87/4129a19d4d56092ed0f63e0739832d145690981631d32f3ac6e438ec0d25/Scrapy-2.9.0-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy: - :x: **Scrapy-2.9.0-py2.py3-none-any.whl** (Vulnerable Library)
Found in HEAD commit: 8dbdb4a1170502df116e35d16ab172d26c02609e
Found in base branch: main
The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data.
Publish Date: 2024-04-16
URL: CVE-2024-3572
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-3572
Release Date: 2024-04-16
Fix Resolution: scrapy - 2.11.1
Step up your Open Source Security Game with Mend here