Skip to content
Fencer Vulns
high 7.5

CVE-2024-1968 json

Authorization Header Leakage in scrapy/scrapy on Scheme Change Redirects

published 2024-05-14 2 y ago modified 2026-06-17 4 mo ago also GHSA-4qqq-9vqf-3h3f , PYSEC-2024-258 , EUVD-2024-1419

cvss
7.5
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in cross-origin requests when the scheme, host, or port changes. Consequently, when a redirect downgrades from HTTPS to HTTP, the Authorization header may be inadvertently exposed in plaintext, leading to potential sensitive information disclosure to unauthorized actors. The flaw is located in the _build_redirect_request function of the redirect middleware.

Patch / fix

  • pypi scrapy 2.0.0, 2.11.2
  • scrapy scrapy/scrapy 2.11.2
  • scrapy scrapy 2.11.2
  • python-scrapy Debian 14, Debian 13 2.11.2-1

debian advisories DEBIAN-CVE-2024-1968

  • python-scrapy Ubuntu Pro 18.04 LTS 1.5.0-1ubuntu0.1~esm1
  • python-scrapy Ubuntu Pro 20.04 LTS 1.7.3-1ubuntu0.1~esm1
  • python-scrapy Ubuntu Pro 22.04 LTS 2.5.1-2ubuntu0.1~esm1
  • python-scrapy Ubuntu Pro 24.04 LTS 2.11.1-1ubuntu0.1~esm2

ubuntu advisories UBUNTU-CVE-2024-1968

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-Scrapy openSUSE Tumbleweed 2.11.2-1.1

opensuse advisories openSUSE-SU-2024:14130-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-1968 updated cvss 7.5

python-scrapy: sensitive information disclosure

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.69% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • huntr.com https://huntr.com/bounties/27f6a021-a891-446a-ada5-0226d619dd1a referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi scrapy
<2.11.2
<2.0.0
>=2.0.0, <2.11.2
2.11.2
2.0.0

Affected products

  • scrapy scrapy/scrapy
  • scrapy scrapy

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.