High severity vulnerability that affects cfscrape · CVE-2017-7235 · GitHub Advisory Database · GitHub

High severity vulnerability that affects cfscrape

High severity GitHub Reviewed Published Jul 13, 2018 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

cfscrape (pip)

Affected versions

>= 1.6.6, <= 1.7.1

Patched versions

1.8.0

Description

An issue was discovered in cloudflare-scrape 1.6.6 through 1.7.1. A malicious website owner could craft a page that executes arbitrary Python code against any cfscrape user who scrapes that website. This is fixed in 1.8.0.

References

Published to the GitHub Advisory Database Jul 13, 2018

Reviewed Jun 16, 2020

Last updated Jan 9, 2023

Severity

High

8.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H