CVE-2024-34069

HIGH EPSS 87.3%
Published May 6, 20242y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published May 6, 2024 2y ago
Last Modified Jun 17, 2026 2w ago

Description

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.

CVSS Details

Base Score
7.5
Exploitability
1.6
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
87.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-352 Cross-Site Request Forgery (CSRF) Authentication

Affected Products 4

VendorProductVersionRange
palletsprojectswerkzeug* <3.0.3
debiandebian_linux11.0any
fedoraprojectfedora38any
fedoraprojectfedora40any

References 6

  • github.com https://github.com/pallets/werkzeug/commit/3386395b24c7371db11a5b8eaac0c91da5362692
    Patch
  • github.com https://github.com/pallets/werkzeug/security/advisories/GHSA-2g68-c3qc-8985
    Vendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/02/msg00026.html
    Mailing ListThird Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4SH32AM3CTPMAAEOIDAN7VU565LO4IR/
    Mailing ListThird Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HFERFN7PINV4MOGMGA3DPIXJPDCYOEJZ/
    Mailing ListThird Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20240614-0004/
    Third Party Advisory

Remediation

  • github.com https://github.com/pallets/werkzeug/commit/3386395b24c7371db11a5b8eaac0c91da5362692
    Patch