PT-2017-7913 · Pallets+1 · Werkzeug+1

Neargle · Publicado 2017-10-23 · Atualizado 2022-05-14 · CVE-2016-10516

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Werkzeug versions prior to 0.11.11

Description A cross-site scripting (XSS) issue exists in the render full function in debug/tbtools.py in the debugger, allowing remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.

Recommendations For versions prior to 0.11.11, update to version 0.11.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the debugger to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-10516

DLA-1191-1

GHSA-H2FP-XGX6-XH6F

PYSEC-2017-43

RHSA-2019:3172

USN-3463-1

Produtos afetados

Ubuntu

Werkzeug

Referências · 18

• https://github.com/pallets/werkzeug/pull/1001 · Nota
• https://github.com/pallets/werkzeug · Nota
• https://github.com/pallets/werkzeug/commit/1034edc7f901dd645ec6e462754111b39002bd65 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/werkzeug/PYSEC-2017-43.yaml · Nota
• http://blog.neargle.com/2016/09/21/flask-src-review-get-a-xss-from-debuger · Nota
• https://lists.debian.org/debian-lts-announce/2017/11/msg00037.html · Nota
• https://osv.dev/vulnerability/PYSEC-2017-43 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10516 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10516 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-10516 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10516 · Nota de Segurança
• https://github.com/advisories/GHSA-h2fp-xgx6-xh6f · Nota
• https://osv.dev/vulnerability/USN-3463-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3463-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2016-10516 · Aviso do Fabricante