CVE-2023-46136

2023-10-2518:17:36

CWE-407

CWE-787

CWE-400

GitHub_M

web.nvd.nist.gov

178

werkzeug

wsgi

web application

library

vulnerability

denial of service

nvd

cve-2023-46136

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

27.9%

JSON

Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1.

Affected configurations

Nvd

Vulners

Node

palletsprojectswerkzeugRange<2.3.8

palletsprojectswerkzeugMatch3.0.0

VendorProductVersionCPE
palletsprojectswerkzeug*cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:*
palletsprojectswerkzeug3.0.0cpe:2.3:a:palletsprojects:werkzeug:3.0.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
palletsprojects	werkzeug	*	cpe:2.3:a:palletsprojects:werkzeug::::::::
palletsprojects	werkzeug	3.0.0	cpe:2.3:a:palletsprojects:werkzeug:3.0.0:::::::*

CNA Affected

[
  {
    "vendor": "pallets",
    "product": "werkzeug",
    "versions": [
      {
        "version": "< 3.0.1",
        "status": "affected"
      }
    ]
  }
]