CVE-2017-7235 cfscrape Improper Input Validation vulnerability
HighCVSS 8.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in cloudflare-scrape 1.6.6 through 1.7.1. A malicious website owner could craft a page that executes arbitrary Python code against any cfscrape user who scrapes that website. This is fixed in 1.8.0.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi cfscrape(PyPI) | >= 1.6.6, < 1.8.0 | 1.8.0 |
| pypi cfscrape(PyPI) | = 1.6.6 | No fix listed |
| pypi cfscrape(PyPI) | = 1.6.7 | No fix listed |
| pypi cfscrape(PyPI) | = 1.6.8 | No fix listed |
| pypi cfscrape(PyPI) | = 1.7.0 | No fix listed |
| pypi cfscrape(PyPI) | = 1.7.1 | No fix listed |
| pypi cfscrape(PyPI) | >= 1.6.6, <= 1.7.1 | No fix listed |
| cloudflare-scrape project cloudflare-scrape | = 1.6.6 | No fix listed |
| cloudflare-scrape project cloudflare-scrape | = 1.6.7 | No fix listed |
| cloudflare-scrape project cloudflare-scrape | = 1.6.8 | No fix listed |
| cloudflare-scrape project cloudflare-scrape | = 1.7.0 | No fix listed |
| cloudflare-scrape project cloudflare-scrape | = 1.7.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking vendor-advisory
- github.com product
- github.com patch vendor-advisory
- github.com vendor-advisory
- github.com
- web.archive.org
- 97191 vdb-entry