Description

In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across domains. The exposure of the Authorization header to unauthorized actors could potentially allow for account hijacking.

INFO

Published Date :

2024-04-16T00:00:15.109Z

Last Modified :

2024-08-01T20:12:08.239Z

Source :

@huntr_ai
AFFECTED PRODUCTS

The following products are affected by CVE-2024-3574 vulnerability.

Vendors Products
Scrapy
  • Scrapy
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-3574.

URL Resource
https://github.com/scrapy/scrapy/commit/5bcb8fd5019c72d05c4a96da78a7fcb6ecb55b75 cve-icon cve-icon cve-icon
https://huntr.com/bounties/49974321-2718-43e3-a152-62b16eed72a9 cve-icon cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact