PT-2024-25679 · Werkzeug+6 · Werkzeug+6
Ry0Tak
·
Published
2024-05-06
·
Updated
2026-01-29
·
CVE-2024-34069
CVSS v2.0
7.6
High
| Vector | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Werkzeug versions prior to 3.0.3
Description
The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger.
Recommendations
For versions prior to 3.0.3, update to version 3.0.3 to resolve the issue. As a temporary workaround, consider restricting access to the debugger or disabling it until the update is applied. Avoid using the debugger on untrusted or public networks, and ensure that the debugger PIN is not easily guessable.
Exploit
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Red Os
Suse
Ubuntu
Werkzeug