CVE-2024-1892
Assigner: @huntr_ai
Published: 2024-02-28T00:00:14.092Z
State: PUBLISHED
title: ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider
descriptions: value: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.
affected: vendor: scrapy
product: scrapy/scrapy
versions: version: unspecified
lessThan: 2.11
status: affected
versionType: custom
metrics: cvssV3_0: version: 3.0
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseScore: 7.5
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-1333 Inefficient Regular Expression Complexity
cweId: CWE-1333
source: advisory: 271f94f2-1e05-4616-ac43-41752389e26b
discovery: EXTERNAL