CVE-2024-3572

Name: CVE-2024-3572
Creator: NVD / NIST
Published: 2024-04-16T00:15:12.387+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.81%

Last modified Jun 17, 2026

CVE-2024-3572 is a vulnerability of currently unknown severity. The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data. EPSS estimates a 0.81% chance of exploitation in the next 30 days.

Description

The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data.

Metrics

EPSS Probability

0.81%

52.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-409

Affected Software

Vendor	Product	Versions
Scrapy	Scrapy	< 2.11.1

References

https://github.com/scrapy/scrapy/commit/809bfac4890f75fc73607318a04d2ccba71b3d9fPatch
https://huntr.com/bounties/c4a0fac9-0c5a-4718-9ee4-2d06d58adabbExploit, Issue Tracking, Third Party Advisory
https://github.com/scrapy/scrapy/commit/809bfac4890f75fc73607318a04d2ccba71b3d9fPatch
https://huntr.com/bounties/c4a0fac9-0c5a-4718-9ee4-2d06d58adabbExploit, Issue Tracking, Third Party Advisory

Timeline

Published: Apr 16, 2024
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2024-3572?

How severe is CVE-2024-3572?

Severity scoring for CVE-2024-3572 is pending analysis. The EPSS model estimates a 0.81% probability of exploitation in the next 30 days.

How do I fix CVE-2024-3572?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-3572?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST