CVE-2024-34069

Katalog CVE

CVSS 7.5 · High EPSS 3,4%

Kerentanan Cross-Site Request Forgery (CSRF) pada palletsprojects werkzeug, debian linux +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.

Rincian

Terbit di NVD

6 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

3,4% peluang dieksploitasi; lebih tinggi dari 88,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pallets/werkzeug/security/advisories/GHSA-2g68-c3qc-8985 advisory vendor
• https://github.com/pallets/werkzeug/commit/3386395b24c7371db11a5b8eaac0c91da5362692 patch
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4SH32AM3CTPMAA... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HFERFN7PINV4MOG... mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20240614-0004/ advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/02/msg00026.html mailing list · advisory pihak ketiga