Medium severity · published Oct 25, 2024
CVE-2024-49766
Werkzeug is a Web Server Gateway Interface web application library
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Werkzeug · Palletsprojects
before 3.0.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-49766
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-49766
Patch
https://github.com/pallets/werkzeug/commit/2767bcb10a7dd1c297d812cc5e6d11a474c1f092
Release Notes
https://github.com/pallets/werkzeug/releases/tag/3.0.6
Vendor Advisory
https://github.com/pallets/werkzeug/security/advisories/GHSA-f9vj-2wh5-fj8j
Third Party Advisory
https://security.netapp.com/advisory/ntap-20250131-0005/
More from Werkzeug
9.8
CVE-2022-29361
Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests…
7.5
CVE-2024-49767
Werkzeug is a Web Server Gateway Interface web application library
7.5
CVE-2024-34069
Werkzeug is a comprehensive WSGI web application library
7.5
CVE-2023-46136
Werkzeug is a comprehensive WSGI web application library
7.5
CVE-2023-25577
Werkzeug is a comprehensive WSGI web application library