CVE-2024-34069

Name of the Vulnerable Software and Affected Versions Werkzeug versions prior to 3.0.3

Description The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger.

Recommendations For versions prior to 3.0.3, update to version 3.0.3 to resolve the issue. As a temporary workaround, consider restricting access to the debugger or disabling it until the update is applied. Avoid using the debugger on untrusted or public networks, and ensure that the debugger PIN is not easily guessable.