CVE-2024-3572 HIGH

CVE-2024-3572: XML External Entity (XXE) Vulnerability in scrapy/scrapy

Vendor Scrapy
Product scrapy/scrapy
Weakness CWE-409
Published April 16, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data.

Key dates

02Disclosure timeline

April 16, 2024 CVE published
August 1, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-21441 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-42886 Audiobookshelf: Memory amplification DoS via oversized compressed details entry in backup upload CVE-2026-27460 Tandoor Recipes Affected by Denial of Service via Recipe Import CVE-2025-69223 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb CVE-2025-62708 pypdf manipulated LZWDecode streams can exhaust RAM