CVE-2022-0577
published 2022-03-02CVE-2022-0577: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.
PriorityP433medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
1.26%
66.8th percentile
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | python-scrapy | < python-scrapy 2.6.1-1 (bookworm) | python-scrapy 2.6.1-1 (bookworm) |
| scrapy | scrapy | < 2.6.1 | 2.6.1 |
| scrapy | scrapy | >= 0 < 1.8.2 | 1.8.2 |
| scrapy | scrapy | >= 2.0.0 < 2.6.1 | 2.6.1 |
| scrapy | scrapy_scrapy | >= unspecified < 2.6.1 | 2.6.1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
osv6.5MEDIUM
vendor_redhat7.8HIGH
vendor_debian6.5MEDIUM
vendor_ubuntu5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Scrapy vulnerabilities
vendor_ubuntu·2025-05-05·CVSS 5.7
CVE-2024-3574 [MEDIUM] Scrapy vulnerabilities
Title: Scrapy vulnerabilities
Summary: Several security issues were fixed in python-scrapy.
It was discovered that Scrapy improperly exposed HTTP authentication
credentials to request targets, including during redirects. An attacker
could use this issue to gain unauthorized access to user accounts. This
issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-41125)
It was discovered that Scrapy did not remove the cookie header during
cross-domain redirects. An attacker could possibly use this issue to gain
unauthorized access to user accounts. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-0577)
It was discovered that Scrapy inefficiently parsed XML content. An
attacker could use this issue to cause a denial of service by sendi
Red Hat
vim: stack buffer overflow in ex_finally() in ex_eval.c
vendor_redhat·2022-09-25·CVSS 7.8
CVE-2022-3296 [HIGH] CWE-121 vim: stack buffer overflow in ex_finally() in ex_eval.c
vim: stack buffer overflow in ex_finally() in ex_eval.c
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.
A stack-based buffer overflow vulnerability was found in vim's ex_finally() function of the src/ex_eval.c file. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering a bug that causes an application to crash, possibly executing code and corrupting memory.
Statement: Red Hat Product Security has rated this issue as having a Low security impact, because the "victim" has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it.
Since Red Hat Enterprise Linux 6, 7 are Out-of-Support-Scope for Low/Moderate flaw
Debian
CVE-2022-0577: python-scrapy - Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ...
vendor_debian·2022·CVSS 6.5
CVE-2022-0577 [MEDIUM] CVE-2022-0577: python-scrapy - Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ...
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.
Scope: local
bookworm: resolved (fixed in 2.6.1-1)
bullseye: resolved (fixed in 2.4.1-2+deb11u1)
forky: resolved (fixed in 2.6.1-1)
sid: resolved (fixed in 2.6.1-1)
trixie: resolved (fixed in 2.6.1-1)
OSV
python-scrapy vulnerabilities
osv·2025-05-05·CVSS 6.5
CVE-2021-41125 [MEDIUM] python-scrapy vulnerabilities
python-scrapy vulnerabilities
It was discovered that Scrapy improperly exposed HTTP authentication
credentials to request targets, including during redirects. An attacker
could use this issue to gain unauthorized access to user accounts. This
issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-41125)
It was discovered that Scrapy did not remove the cookie header during
cross-domain redirects. An attacker could possibly use this issue to gain
unauthorized access to user accounts. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-0577)
It was discovered that Scrapy inefficiently parsed XML content. An
attacker could use this issue to cause a denial of service by sending a
crafted XML response. This issue only affected Ubuntu 18.0
OSV
CVE-2022-0577: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2
osv·2022-03-02·CVSS 6.5
CVE-2022-0577 [MEDIUM] CVE-2022-0577: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.
OSV
Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy
osv·2022-03-01
CVE-2022-0577 [MEDIUM] Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy
Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy
### Impact
If you manually define cookies on a [`Request`](https://docs.scrapy.org/en/latest/topics/request-response.html#scrapy.http.Request) object, and that `Request` object gets a redirect response, the new `Request` object scheduled to follow the redirect keeps those user-defined cookies, regardless of the target domain.
### Patches
Upgrade to Scrapy 2.6.0, which resets cookies when creating `Request` objects to follow redirects¹, and drops the ``Cookie`` header if manually-defined if the redirect target URL domain name does not match the source URL domain name².
If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1
GHSA
Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy
ghsa·2022-03-01
CVE-2022-0577 [MEDIUM] CWE-200 Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy
Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy
### Impact
If you manually define cookies on a [`Request`](https://docs.scrapy.org/en/latest/topics/request-response.html#scrapy.http.Request) object, and that `Request` object gets a redirect response, the new `Request` object scheduled to follow the redirect keeps those user-defined cookies, regardless of the target domain.
### Patches
Upgrade to Scrapy 2.6.0, which resets cookies when creating `Request` objects to follow redirects¹, and drops the ``Cookie`` header if manually-defined if the redirect target URL domain name does not match the source URL domain name².
If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/scrapy/scrapy/commit/8ce01b3b76d4634f55067d6cfdf632ec70ba304ahttps://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585https://lists.debian.org/debian-lts-announce/2022/03/msg00021.htmlhttps://github.com/scrapy/scrapy/commit/8ce01b3b76d4634f55067d6cfdf632ec70ba304ahttps://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585https://lists.debian.org/debian-lts-announce/2022/03/msg00021.html
2022-03-02
Published