CVE-2024-3574
High
Description
In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across domains. The exposure of the Authorization header to unauthorized actors could potentially allow for account hijacking.
SeverityHigh
CVSS7.5
Exploit probability—
ProductScrapy
PublishedApr 16, 2024
First seenApr 16, 2024
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- scrapy scrapy2.11.1 or later
- scrapy2.11.1, 1.8.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| scrapy scrapy | v < 2.11.1 | 2.11.1 |
| scrapyPyPI | 2 ≤ v < 2.11.1, v < 1.8.4 | 2.11.1, 1.8.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.