CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
56.2%
A vulnerability in the WSGI Werkzeug web application library is related to the fact that the application does not properly control the consumption of internal resources when parsing data from a composite form with a large number of fields.
internal resource consumption when parsing data from a composite form with a large number of fields.
Exploitation of the vulnerability could allow an attacker acting remotely to cause resource exhaustion and
execute a denial-of-service attack
A vulnerability in the WSGI Werkzeug web application library is related to the application not properly controlling the
internal resource consumption when parsing data from a composite form with a large number of fields.
Exploitation of the vulnerability could allow an attacker acting remotely to tamper with the cookie file
The WSGI Werkzeug web application library vulnerability involves downloading a file starting with CR or LF,
accompanied by megabytes of data without these characters: all of these bytes are added piecemeal to the
internal bytearray array, and a boundary search is performed on the growing buffer. Exploiting the vulnerability
could allow an attacker acting remotely to cause a denial of service
The WSGI Werkzeug web application library vulnerability is related to the ability for an attacker to execute code
on the developer’s machine. Exploitation of the vulnerability could allow an attacker acting remotely,
gain access to the debugger and execute arbitrary code
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
redos | 7.3 | x86_64 | python3-werkzeug | < 3.0.3-1 | UNKNOWN |