CVE-2023-23934

    Dashboard / Vulnerabilities / CVE-2023-23934

    CVE-2023-23934

    Published: 14 Feb 2023Last Modified: 28 Oct 2026

    Summary: Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass

    Details: Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.

    References: https://github.com/pallets/werkzeug/releases/tag/2.2.3, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23934.json, https://github.com/pallets/werkzeug/security/advisories/GHSA-px8h-6qxv-m22q, https://nvd.nist.gov/vuln/detail/CVE-2023-23934, https://security.netapp.com/advisory/ntap-20230818-0003/, https://www.debian.org/security/2023/dsa-5470, https://github.com/pallets/werkzeug/commit/cf275f42acad1b5950c50ffe8ef58fe62cdce028

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -22a254fca2ad0130adbbcbd11d3de51bcb04a08b

    Affected versions

    2.2.2
    2.2.1
    2.2.0
    2.2.0a1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-23934 | CVE-DB