vulnerability

Red Hat OpenShift: CVE-2024-34069: python-werkzeug: user may execute code on a developer's machine

Name: Red Hat OpenShift: CVE-2024-34069: python-werkzeug: user may execute code on a developer's machine
Creator: Red Hat
Published: 2024-05-06T00:00:00.000Z
Keywords: CVE, CWE-352, Red Hat OpenShift, 2024, 34069, python, linuxrpm-upgrade-python-werkzeug, linuxrpm-upgrade-rhcos, Severity 8

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:H/Au:N/C:C/I:C/A:C)

Published

May 6, 2024

Added

Aug 30, 2024

Modified

Jun 17, 2026

Description

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.

Solutions

linuxrpm-upgrade-python-werkzeuglinuxrpm-upgrade-rhcos

References

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report