CVE-2022-0577: debian debian_linux
CVSS: 8.8v3.0HighModified
AliasesGHSA-cjvr-mfj7-j4j8PYSEC-2022-159UBUNTU-CVE-2022-0577DEBIAN-CVE-2022-0577
Published 02-03-2022Last modified 02-08-2024
Vulnerability summary
CVE-2022-0577 is a high (CVSS 8.8) vulnerability in debian debian_linux. EPSS estimates a 1.23% chance of exploitation in the next 30 days, higher than 68.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.8/10
010
High · v3.0 (CVE.org)EPSS score
1.23%
0%100%
Low · -0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 02-03-2022PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.
CVSS metrics
8 scores · 5 sources · 3 versionsMedium 6.5Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
High 8.8Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Medium 4.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
1.23%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
-0.04 pp
From 1.26% on 20-09-2026
20-09-202620-10-2026
EPSS score1.23%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (huntr.dev)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Debian2 products
- python-scrapy< 2.6.1-1
- debian_linuxEOL9.0
Scrapy2 products
- scrapy< 2.6.1
- scrapy/scrapy≥ unspecified, < 2.6.1
PyPI1 product
- scrapy< 1.8.2 | ≥ 2.0.0, < 2.6.0 | < 8ce01b3b76d4634f55067d6cfdf632ec70ba304a | < 2.6.1
Ubuntu1 product
- python-scrapyAll versions (No fix recorded) | < 1.5.0-1ubuntu0.1~esm1 | < 1.7.3-1ubuntu0.1~esm1 | < 2.5.1-2ubuntu0.1~esm1
4 vendors · 6 products
References
12 links- huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585X Refsource CONFIRMWEBREPORTExploitIssue TrackingPatchThird Party Advisory
- github.com/scrapy/scrapy/commit/8ce01b3b76d4634f55067d6cfdf632ec70ba304aX Refsource MISCWEBFIXREPORTPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2022/03/msg00021.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
- github.com/scrapy/scrapyPACKAGE