CVE-2016-10516 Pallets Werkzeug cross-site scripting vulnerability
MediumCVSS 6.1
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi werkzeug(PyPI) | < 0.11.11 | 0.11.11 |
| pypi werkzeug(PyPI) | = 0.1 | No fix listed |
| pypi werkzeug(PyPI) | = 0.10 | No fix listed |
| pypi werkzeug(PyPI) | = 0.10.1 | No fix listed |
| pypi werkzeug(PyPI) | = 0.10.2 | No fix listed |
| pypi werkzeug(PyPI) | = 0.10.3 | No fix listed |
| pypi werkzeug(PyPI) | = 0.10.4 | No fix listed |
| pypi werkzeug(PyPI) | = 0.11 | No fix listed |
| pypi werkzeug(PyPI) | = 0.11.1 | No fix listed |
| pypi werkzeug(PyPI) | = 0.11.10 | No fix listed |
| pypi werkzeug(PyPI) | = 0.11.2 | No fix listed |
| pypi werkzeug(PyPI) | = 0.11.3 | No fix listed |
| pypi werkzeug(PyPI) | = 0.11.4 | No fix listed |
| pypi werkzeug(PyPI) | = 0.11.5 | No fix listed |
| pypi werkzeug(PyPI) | = 0.11.6 | No fix listed |
| pypi werkzeug(PyPI) | = 0.11.7 | No fix listed |
| pypi werkzeug(PyPI) | = 0.11.8 | No fix listed |
| pypi werkzeug(PyPI) | = 0.11.9 | No fix listed |
| pypi werkzeug(PyPI) | = 0.2 | No fix listed |
| pypi werkzeug(PyPI) | = 0.3 | No fix listed |
| pypi werkzeug(PyPI) | = 0.3.1 | No fix listed |
| pypi werkzeug(PyPI) | = 0.4 | No fix listed |
| pypi werkzeug(PyPI) | = 0.4.1 | No fix listed |
| pypi werkzeug(PyPI) | = 0.5 | No fix listed |
| pypi werkzeug(PyPI) | = 0.5.1 | No fix listed |
Show 21 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi werkzeug(PyPI) | = 0.6 | No fix listed |
| pypi werkzeug(PyPI) | = 0.6.1 | No fix listed |
| pypi werkzeug(PyPI) | = 0.6.2 | No fix listed |
| pypi werkzeug(PyPI) | = 0.7 | No fix listed |
| pypi werkzeug(PyPI) | = 0.7.1 | No fix listed |
| pypi werkzeug(PyPI) | = 0.7.2 | No fix listed |
| pypi werkzeug(PyPI) | = 0.8 | No fix listed |
| pypi werkzeug(PyPI) | = 0.8.1 | No fix listed |
| pypi werkzeug(PyPI) | = 0.8.2 | No fix listed |
| pypi werkzeug(PyPI) | = 0.8.3 | No fix listed |
| pypi werkzeug(PyPI) | = 0.9 | No fix listed |
| pypi werkzeug(PyPI) | = 0.9.1 | No fix listed |
| pypi werkzeug(PyPI) | = 0.9.2 | No fix listed |
| pypi werkzeug(PyPI) | = 0.9.3 | No fix listed |
| pypi werkzeug(PyPI) | = 0.9.4 | No fix listed |
| pypi werkzeug(PyPI) | = 0.9.5 | No fix listed |
| pypi werkzeug(PyPI) | = 0.9.6 | No fix listed |
| debian/python-werkzeug(Debian:12) | < 0.11.11+dfsg1-1 | 0.11.11+dfsg1-1 |
| debian/python-werkzeug(Debian:13) | < 0.11.11+dfsg1-1 | 0.11.11+dfsg1-1 |
| debian/python-werkzeug(Debian:14) | < 0.11.11+dfsg1-1 | 0.11.11+dfsg1-1 |
| palletsprojects werkzeug | < 0.11.11 | 0.11.11 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com patch
- github.com vendor-advisory
- github.com product
- github.com
- [debian-lts-announce] 20171124 [SECURITY] [DLA 1191-1] python-werkzeug security update mailing-list
- blog.neargle.com issue-tracking technical-description
- Debian Security Tracker CVE-2016-10516 vendor-advisory