GitHub Advisoryadvisory · PyPI

GHSA-2g68-c3qc-8985 Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

HIGH Published 2024-05-06 Modified 2025-02-21 Official page ↗
Aliases
CVE-2024-34069
Ecosystem
PyPI
Packages
Werkzeug
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2024-05-06

Affected packages

• PyPI Werkzeug: < 3.0.3 → fixed in 3.0.3

Description

The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger.

Related

Alias · CVE (1)

  • CVE-2024-34069 Werkzeug is a comprehensive WSGI web application library. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References