CVE-2023-7079CWE-287

Arbitrary remote file read in Wrangler dev server

Medium · published December 29, 2023

CVSS v3.1
6.4
EPSS
1%
Percentile
52.6
In the wild
Unconfirmed
What it is

Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00699 · 52.6th percentile
Weakness
CWE-287 · Improper Authentication
Published
2023-12-29T11:54Z
EPSS history
Timeline
  • 29 DEC 11:54Z
    Arbitrary remote file read in Wrangler dev server
    cvelistv5