PT-2017-7913 · Pallets+1 · Werkzeug+1

Neargle · Published 2017-10-23 · Updated 2022-05-14 · CVE-2016-10516

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Werkzeug versions prior to 0.11.11

Description A cross-site scripting (XSS) issue exists in the render full function in debug/tbtools.py in the debugger, allowing remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.

Recommendations For versions prior to 0.11.11, update to version 0.11.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the debugger to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-10516

DLA-1191-1

GHSA-H2FP-XGX6-XH6F

PYSEC-2017-43

RHSA-2019:3172

USN-3463-1

Affected Products

Ubuntu

Werkzeug

References · 18

• https://osv.dev/vulnerability/PYSEC-2017-43 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10516 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10516 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-10516 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10516 · Security Note
• https://osv.dev/vulnerability/USN-3463-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3463-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-10516 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-10516 · Security Note
• https://ubuntu.com/security/CVE-2016-10516 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h2fp-xgx6-xh6f · Vendor Advisory
• https://github.com/pallets/werkzeug/pull/1001 · Note
• https://github.com/pallets/werkzeug · Note
• https://github.com/pallets/werkzeug/commit/1034edc7f901dd645ec6e462754111b39002bd65 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/werkzeug/PYSEC-2017-43.yaml · Note