CVE-2024-3572CWE-409

XML External Entity (XXE) Vulnerability in scrapy/scrapy

High · published April 16, 2024

CVSS v3.0
7.5
EPSS
1%
Percentile
56.6
In the wild
Unconfirmed
What it is

The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00814 · 56.6th percentile
Weakness
CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
Published
2024-04-16T00:00Z
EPSS history
Timeline
  • 16 APR 00:00Z
    XML External Entity (XXE) Vulnerability in scrapy/scrapy
    cvelistv5