CVE-2016-10516 — Cross-site Scripting in Werkzeug

CWE-79 — Cross-site Scripting11 documents8 sources
Severity
6.1MEDIUMNVD
EPSS
0.4%
top 38.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Palletsprojects Werkzeug
Timeline
PublishedOct 23
Latest updateMay 14

Description

Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶PyPIpalletsprojects/werkzeug< 0.11.11

🔴Vulnerability Details

4
GHSA
Pallets Werkzeug cross-site scripting vulnerability↗2022-05-14
▶
OSV
Pallets Werkzeug cross-site scripting vulnerability↗2022-05-14
▶
CVEList
CVE-2016-10516: Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools↗2017-10-23
▶
OSV
CVE-2016-10516: Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools↗2017-10-23
▶

📋Vendor Advisories

3
Ubuntu
Werkzeug vulnerability↗2017-10-25
▶
Red Hat
python-werkzeug: Cross-site scripting in render_full function in debug/tbtools.py↗2017-10-23
▶
Debian
CVE-2016-10516: python-werkzeug - Cross-site scripting (XSS) vulnerability in the render_full function in debug/tb...↗2016
▶

💬Community

3
Bugzilla
CVE-2016-10516 python-werkzeug: Cross-site scripting in render_full function in debug/tbtools.py [epel-6]↗2017-11-10
▶
Bugzilla
CVE-2016-10516 python-werkzeug: Cross-site scripting in render_full function in debug/tbtools.py [fedora-all]↗2017-11-10
▶
Bugzilla
CVE-2016-10516 python-werkzeug: Cross-site scripting in render_full function in debug/tbtools.py↗2017-11-10
▶
CVE-2016-10516 — Cross-site Scripting in Werkzeug | cvebase