CVE-2016-10516

python-werkzeug: Cross-site scripting in render_full function in debug/tbtools.py

Published Oct 23, 2017 CVSS 3.0 · 6.1 Medium EPSS 2.0% KEV · Not listed
Description
Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-1191-1 python-werkzeug security update
EUVD EUVD EUVD-2017-0141 Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.
Github GHSA Github GHSA GHSA-h2fp-xgx6-xh6f Pallets Werkzeug cross-site scripting vulnerability
Ubuntu USN Ubuntu USN USN-3463-1 Werkzeug vulnerability
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 6, 2024, 3:21 AM
Reserved
Oct 23, 2017, 12:00 AM
Status
Modified
Published
Oct 23, 2017, 4:29 PM
Modified
Jun 17, 2026, 12:39 AM
Severity
Moderate
Public date
Oct 23, 2017, 12:00 AM