CVE-2023-23934

A flaw was found in python-werkzeug. Browsers may allow "nameless" cookies like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie for another subdomain. If a Werkzeug application is running next to a...

CVE-2023-23934

CVE-2023-23934 affects the Werkzeug WSGI library. A bug in parsing nameless cookies (e.g., =__Host-test=bad) can lead to cookie shadowing where the cookie value is set for one subdomain but read as a different key by adjacent subdomains. The issue applies to Werkzeug versions before 2.2.3 and is ...