Werkzeug@2.3.5 vulnerabilities
The comprehensive WSGI web application library.
-
latest version
3.0.3
-
latest non vulnerable version
-
first published
16 years ago
-
latest version published
17 days ago
-
licenses detected
- [0,)
Direct Vulnerabilities
Known vulnerabilities in the Werkzeug package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.| Vulnerability | Vulnerable Version |
|---|---|
Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to insufficient hostname checks and the use of relative paths to resolve requests. When the debugger is enabled, an attacker can convince a user to enter their own PIN to interact with a domain and subdomain they control, and thereby cause malicious code to be executed. The demonstrated attack vector requires a number of conditions that render this attack very difficult to achieve, especially if the victim application is running in the recommended configuration of not having the debugger enabled in production. How to fix Remote Code Execution (RCE)? Upgrade |
[,3.0.3)
|
Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in multipart data parsing. An attacker can cause a denial of service and block worker processes from handling legitimate requests by sending crafted multipart data to an endpoint that will parse it, eventually exhausting or killing all available workers. Exploiting this vulnerability is possible if the uploaded file starts with How to fix Inefficient Algorithmic Complexity? Upgrade |
[,2.3.8)
[3.0.0,3.0.1)
|