CVE-2024-3572
Assigner: @huntr_ai
Published: 2024-04-16T00:00:14.499Z
State: PUBLISHED
title: XML External Entity (XXE) Vulnerability in scrapy/scrapy
descriptions: value: The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data. 
affected: vendor: scrapy
product: scrapy/scrapy
versions: version: unspecified
lessThan: 2.11.1
status: affected
versionType: custom
metrics: cvssV3_0: version: 3.0
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseScore: 7.5
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
cweId: CWE-409
source: advisory: c4a0fac9-0c5a-4718-9ee4-2d06d58adabb
discovery: EXTERNAL