PT-2017-17597 · Cloudflare · Cloudflare-Scrape

Franciscouzo · Publicado 2017-03-23 · Atualizado 2019-10-03 · CVE-2017-7235

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cloudflare-scrape versions 1.6.6 through 1.7.1

Description A malicious website owner could craft a page that executes arbitrary Python code against any cfscrape user who scrapes that website.

Recommendations For versions 1.6.6 through 1.7.1, update to version 1.8.0 to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-7235

GHSA-5MC5-5J6C-QMF9

PYSEC-2017-7

Produtos afetados

Cloudflare-Scrape

Referências · 11

• https://github.com/Anorov/cloudflare-scrape/issues/97 · Aviso do Fabricante
• https://github.com/Anorov/cloudflare-scrape/releases/tag/1.8.0 · Aviso do Fabricante
• https://github.com/Anorov/cloudflare-scrape · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/cfscrape/PYSEC-2017-7.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7235 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2017-7 · Aviso do Fabricante
• https://github.com/advisories/GHSA-5mc5-5j6c-qmf9 · Nota
• https://osv.dev/vulnerability/CVE-2017-7235 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-5mc5-5j6c-qmf9 · Aviso do Fabricante
• http://securityfocus.com/bid/97191 · Nota
• https://web.archive.org/web/20170701161512/http://securityfocus.com/bid/97191 · Nota