CVE-2022-0577 Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy
An attacker can access sensitive information from the Scrapy web scraping library due to improper authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-0577?
CVE-2022-0577 is a high-severity vulnerability in Debian Debian Linux, published on 2 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.
Which versions are affected by CVE-2022-0577?
5 open source packages ship an affected version, including scrapy. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
scrapy PyPI | All versions | 1.8.2 |
scrapy PyPI | All versions | 1.8.2 |
scrapy PyPI | All versions | 2.6.1 |
scrapy PyPI | From 2.0.0 | 2.6.0 |
scrapy PyPI | From 2.0.0 | 2.6.0 |
Products include Debian Debian Linux, Scrapy Scrapy.
How do I fix CVE-2022-0577?
Upgrade scrapy to a fixed version for your release line: 1.8.2, 2.6.1 or 2.6.0.
Is CVE-2022-0577 being exploited?
There is no known exploitation of CVE-2022-0577 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2022-0577, GHSA-cjvr-mfj7-j4j8, PYSEC-2022-159, UBUNTU-CVE-2022-0577, openSUSE-SU-2024:11889-1.