Fluid Attacks Database

Description

Pallets Werkzeug vulnerable to Path Traversal In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	werkzeug	>=0 <0.15.5	0.15.5

Aliases

1. CVE-2019-143222. NVD-2019-143223. OSV-2019-143224. GCVE-2019-14322

References

1. https://github.com/pallets/werkzeug2. https://palletsprojects.com/blog/werkzeug-0-15-5-released3. http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html4. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14322.yaml5. https://github.com/faisalfs10x/CVE-2019-14322-scanner

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.