CVE-2024-49766
Medium
Description
Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.
SeverityMedium
CVSS5.3
Exploit probability—
ProductPalletsprojects Werkzeug
PublishedOct 25, 2024
First seenOct 25, 2024
Weakness typeCWE-22Path traversal
How to fix
Update
- palletsprojects werkzeug3.0.6 or later
- werkzeug3.0.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| palletsprojects werkzeug | v < 3.0.6 | 3.0.6 |
| werkzeugPyPI | v < 3.0.6 | 3.0.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.