Path Traversal in Cloudflare Wrangler
CVE-2023-3348
The Wrangler command line tool (<=wrangler@3.1.0 or <=wrangler@2.20.1) was affected by a directory traversal vulnerability when running a local development server for Pages (wrangler pages dev command). This vulnerability enabled an attacker in the same network as the victim to connect to the local development server and access the victim's files present outside of the directory for the development server.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.007 (49.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
Affected products
- Cloudflare Wrangler — versions 3, 2
Weakness classification (CWE)
References
- cna@cloudflare.com (vendor-advisory, Vendor Advisory)
- cna@cloudflare.com (Product, product)
- cna@cloudflare.com (related, Product)
Frequently asked questions
- What is CVE-2023-3348?
- CVE-2023-3348 is a medium-severity vulnerability in Cloudflare Wrangler, classified under Path Traversal. CVSS score: 5.7/10. Published 2023-08-03.
- How severe is CVE-2023-3348?
- Medium severity. CVSS v3 base score is 5.7 out of 10.