Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.
Advisories
Source ID Title
Debian DLA Debian DLA DLA-4062-1 python-werkzeug security update
EUVD EUVD EUVD-2024-1358 Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.
Github GHSA Github GHSA GHSA-2g68-c3qc-8985 Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain
Ubuntu USN Ubuntu USN USN-6799-1 Werkzeug vulnerability
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Thu, 04 Dec 2025 00:45:00 +0900

Type Values Removed Values Added
First Time appeared Debian
Debian debian Linux
Fedoraproject
Fedoraproject fedora
CPEs cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
Vendors & Products Debian
Debian debian Linux
Fedoraproject
Fedoraproject fedora

Wed, 16 Jul 2025 22:45:00 +0900

Type Values Removed Values Added
Metrics epss

{'score': 0.00156}

epss

{'score': 0.00212}


Mon, 23 Jun 2025 23:30:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:ceph_storage:7.1::el9

Fri, 09 May 2025 00:00:00 +0900

Type Values Removed Values Added
First Time appeared Redhat ceph Storage
CPEs cpe:/a:redhat:ceph_storage:7.1::el8
Vendors & Products Redhat ceph Storage

Sat, 22 Feb 2025 03:30:00 +0900

Type Values Removed Values Added
References

Fri, 14 Feb 2025 03:15:00 +0900

Type Values Removed Values Added
First Time appeared Palletsprojects
Palletsprojects werkzeug
CPEs cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:*
Vendors & Products Palletsprojects
Palletsprojects werkzeug
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Tue, 03 Dec 2024 11:45:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openstack:16.2::el8

Mon, 25 Nov 2024 11:30:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.15::el8

Sat, 23 Nov 2024 01:00:00 +0900

Type Values Removed Values Added
First Time appeared Redhat openstack
CPEs cpe:/a:redhat:openstack:17.1::el8
cpe:/a:redhat:openstack:17.1::el9
Vendors & Products Redhat openstack

Thu, 07 Nov 2024 00:15:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.14::el8

Fri, 06 Sep 2024 23:00:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_ironic:4.15::el9

Thu, 29 Aug 2024 19:30:00 +0900

Type Values Removed Values Added
First Time appeared Redhat openshift Ironic
CPEs cpe:/a:redhat:openshift_ironic:4.12::el9
Vendors & Products Redhat openshift Ironic

Wed, 14 Aug 2024 08:00:00 +0900

Type Values Removed Values Added
First Time appeared Redhat
Redhat openshift
CPEs cpe:/a:redhat:openshift:4.16::el9
Vendors & Products Redhat
Redhat openshift

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-02-21T18:03:28.226Z

Reserved: 2024-04-30T06:56:33.381Z

Link: CVE-2024-34069

cve-icon Vulnrichment

Updated: 2025-02-21T18:03:28.226Z

cve-icon NVD

Status : Analyzed

Published: 2024-05-06T15:15:23.990

Modified: 2025-12-03T15:32:11.177

Link: CVE-2024-34069

cve-icon Redhat

Severity : Important

Publid Date: 2024-05-06T00:00:00Z

Links: CVE-2024-34069 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses