CVE-2024-3574
published 2024-04-16CVE-2024-3574: In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party…
PriorityP345high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EPSS
0.64%
47.3th percentile
In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across domains. The exposure of the Authorization header to unauthorized actors could potentially allow for account hijacking.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-scrapy | < python-scrapy 2.11.1-1 (forky) | python-scrapy 2.11.1-1 (forky) |
| scrapy | scrapy | < 2.11.1 | 2.11.1 |
| scrapy | scrapy | >= 0 < 1.8.4 | 1.8.4 |
| scrapy | scrapy | >= 2 < 2.11.1 | 2.11.1 |
| scrapy | scrapy_scrapy | >= unspecified < 2.11.1 | 2.11.1 |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_ubuntu5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-scrapy vulnerabilities
osv·2025-05-05·CVSS 6.5
CVE-2021-41125 [MEDIUM] python-scrapy vulnerabilities
python-scrapy vulnerabilities
It was discovered that Scrapy improperly exposed HTTP authentication
credentials to request targets, including during redirects. An attacker
could use this issue to gain unauthorized access to user accounts. This
issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-41125)
It was discovered that Scrapy did not remove the cookie header during
cross-domain redirects. An attacker could possibly use this issue to gain
unauthorized access to user accounts. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-0577)
It was discovered that Scrapy inefficiently parsed XML content. An
attacker could use this issue to cause a denial of service by sending a
crafted XML response. This issue only affected Ubuntu 18.0
OSV
CVE-2024-3574: In scrapy version 2
osv·2024-04-16·CVSS 7.5
CVE-2024-3574 [HIGH] CVE-2024-3574: In scrapy version 2
In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across domains. The exposure of the Authorization header to unauthorized actors could potentially allow for account hijacking.
GHSA
Scrapy authorization header leakage on cross-domain redirect
ghsa·2024-02-15
CVE-2024-3574 [HIGH] CWE-200 Scrapy authorization header leakage on cross-domain redirect
Scrapy authorization header leakage on cross-domain redirect
### Impact
When you send a request with the `Authorization` header to one domain, and the response asks to redirect to a different domain, Scrapy’s built-in redirect middleware creates a follow-up redirect request that keeps the original `Authorization` header, leaking its content to that second domain.
The [right behavior](https://fetch.spec.whatwg.org/#ref-for-cors-non-wildcard-request-header-name) would be to drop the `Authorization` header instead, in this scenario.
### Patches
Upgrade to Scrapy 2.11.1.
If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.11.1 is not an option, you may upgrade to Scrapy 1.8.4 instead.
### Workarounds
If you cannot upgrade, make sure that you are not using the `Aut
OSV
Scrapy authorization header leakage on cross-domain redirect
osv·2024-02-15
CVE-2024-3574 [HIGH] Scrapy authorization header leakage on cross-domain redirect
Scrapy authorization header leakage on cross-domain redirect
### Impact
When you send a request with the `Authorization` header to one domain, and the response asks to redirect to a different domain, Scrapy’s built-in redirect middleware creates a follow-up redirect request that keeps the original `Authorization` header, leaking its content to that second domain.
The [right behavior](https://fetch.spec.whatwg.org/#ref-for-cors-non-wildcard-request-header-name) would be to drop the `Authorization` header instead, in this scenario.
### Patches
Upgrade to Scrapy 2.11.1.
If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.11.1 is not an option, you may upgrade to Scrapy 1.8.4 instead.
### Workarounds
If you cannot upgrade, make sure that you are not using the `Aut
Ubuntu
Scrapy vulnerabilities
vendor_ubuntu·2025-05-05·CVSS 5.7
CVE-2024-3574 [MEDIUM] Scrapy vulnerabilities
Title: Scrapy vulnerabilities
Summary: Several security issues were fixed in python-scrapy.
It was discovered that Scrapy improperly exposed HTTP authentication
credentials to request targets, including during redirects. An attacker
could use this issue to gain unauthorized access to user accounts. This
issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-41125)
It was discovered that Scrapy did not remove the cookie header during
cross-domain redirects. An attacker could possibly use this issue to gain
unauthorized access to user accounts. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-0577)
It was discovered that Scrapy inefficiently parsed XML content. An
attacker could use this issue to cause a denial of service by sendi
Debian
CVE-2024-3574: python-scrapy - In scrapy version 2.10.1, an issue was identified where the Authorization header...
vendor_debian·2024·CVSS 7.5
CVE-2024-3574 [HIGH] CVE-2024-3574: python-scrapy - In scrapy version 2.10.1, an issue was identified where the Authorization header...
In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across domains. The exposure of the Authorization header to unauthorized actors could potentially allow for account hijacking.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2.11.1-1)
sid: resolved (fixed in 2.11.1-1)
trixie: resolved (fixed in 2.11.1-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-04-16
Published