CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23934 – Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass
https://notcve.org/view.php?id=CVE-2023-23934
Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. • https://github.com/pallets/werkzeug/commit/cf275f42acad1b5950c50ffe8ef58fe62cdce028 https://github.com/pallets/werkzeug/releases/tag/2.2.3 https://github.com/pallets/werkzeug/security/advisories/GHSA-px8h-6qxv-m22q https://security.netapp.com/advisory/ntap-20230818-0003 https://www.debian.org/security/2023/dsa-5470 https://access.redhat.com/security/cve/CVE-2023-23934 https://bugzilla.redhat.com/show_bug.cgi?id=2170243 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-29361
https://notcve.org/view.php?id=CVE-2022-29361
Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project ** EN DISPUTA ** Un análisis inapropiado de las peticiones HTTP en Pallets Werkzeug versiones v2.1.0 y anteriores, permite a atacantes llevar a cabo un contrabando de peticiones HTTP usando una petición HTTP diseñada con múltiples peticiones incluidas en el cuerpo. NOTA: la posición del proveedor es que este comportamiento sólo puede ocurrir en configuraciones no soportadas que implican el modo de desarrollo y un servidor HTTP desde fuera del proyecto Werkzeug • https://github.com/kevin-mizu/Werkzeug-CVE-2022-29361-PoC https://github.com/pallets/werkzeug/commit/9a3a981d70d2e9ec3344b5192f86fcaf3210cd85 https://github.com/pallets/werkzeug/issues/2420 • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-28724
https://notcve.org/view.php?id=CVE-2020-28724
Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL. Una vulnerabilidad de redireccionamiento abierto en werkzeug versiones anteriores a 0.11.6 por medio de una barra doble en la URL • https://github.com/pallets/flask/issues/1639 https://github.com/pallets/werkzeug/issues/822 https://github.com/pallets/werkzeug/pull/890/files • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-14806
https://notcve.org/view.php?id=CVE-2019-14806
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id. Pallets Werkzeug en versiones anteriores a 0.15.3, cuando es usado con Docker, presenta una aleatoriedad insuficiente del PIN del depurador porque los contenedores Docker comparten la mismo id de máquina. • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168 https://github.com/pallets/werkzeug/commit/00bc43b1672e662e5e3b8cecd79e67fc968fa246 https://palletsprojects.com/blog/werkzeug-0-15-3-released • CWE-331: Insufficient Entropy •
CVSS: 7.5EPSS: 84%CPEs: 2EXPL: 3CVE-2019-14322 – Pallets Werkzeug 0.15.4 - Path Traversal
https://notcve.org/view.php?id=CVE-2019-14322
In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames. En Werkzeug de Pallets anterior a versión 0.15.5, la función SharedDataMiddleware maneja inapropiadamente los nombres de las unidades (tal y como C:) en los nombres de ruta de Windows. • https://www.exploit-db.com/exploits/50101 https://github.com/faisalfs10x/CVE-2019-14322-scanner http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html https://palletsprojects.com/blog/werkzeug-0-15-5-released • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •