Cyber Resilience

CVE-2022-0577

MediumPublic PoC

Published: 02 March 2022

Published
02 March 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0021 43.4th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-0577 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Scrapy Scrapy. Its CVSS base score is 6.5 (Medium).

Operationally, ranked at the 43.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

scrapy
scrapy
≤ 2.6.1
debian
debian linux
9.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-863 CWE-200

Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.

addresses: CWE-863 CWE-200

Ensures authorization decisions for external system use are correctly implemented and enforced.

addresses: CWE-863 CWE-200

It assists users in evaluating and applying correct authorization decisions when sharing information with external partners.

addresses: CWE-200 CWE-863

Session auditing enables detection of unauthorized exposure or access to sensitive information during user activities.

addresses: CWE-863 CWE-200

Drives review and correction of flawed authorization logic applied to organizational data.

addresses: CWE-200 CWE-863

Annual reviews and proposal scrutiny detect and block matching programs that would expose sensitive data to unauthorized recipients or systems.

addresses: CWE-863 CWE-200

Restricts processing strictly to documented authorized uses, mitigating incorrect authorization decisions for sensitive data.

addresses: CWE-863 CWE-200

Addresses incorrect authorization by requiring independent verification of results and an opportunity to contest before any adverse action is taken.

References