Miggo Logo
Miggo Vulnerability Database
→
CVE-2016-10516

CVE-2016-10516: Pallets Werkzeug cross-site scripting vulnerability

6.1

CVSS Score
3.0

Basic Information

CVE ID
CVE-2016-10516
GHSA ID
GHSA-h2fp-xgx6-xh6f
EPSS Score
0.54018%
CWE
CWE-79
Published
5/14/2022
Updated
11/19/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
Werkzeugpip< 0.11.110.11.11

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The GitHub patch shows the vulnerability was fixed by adding escape(self.plaintext) in werkzeug/debug/tbtools.py's render_full function. The CVE description explicitly mentions render_full as the vulnerable entry point, and the commit diff demonstrates the lack of output encoding for the plaintext variable prior to patching, which matches the XSS vulnerability pattern described.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ross-sit* s*riptin* (XSS) vuln*r**ility in t** r*n**r_*ull *un*tion in ***u*/t*tools.py in t** ***u***r in P*ll*ts W*rkz*u* ***or* *.**.** (*s us** in P*ll*ts *l*sk *n* ot**r pro*u*ts) *llows r*mot* *tt**k*rs to inj**t *r*itr*ry w** s*ript or *TML v

Reasoning

T** *it*u* p*t** s*ows t** vuln*r**ility w*s *ix** *y ***in* *s**p*(s*l*.pl*int*xt) in w*rkz*u*/***u*/t*tools.py's r*n**r_*ull *un*tion. T** *V* **s*ription *xpli*itly m*ntions r*n**r_*ull *s t** vuln*r**l* *ntry point, *n* t** *ommit *i** **monstr*t